CVE-2020-7598

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.

Recommendation

Upgrade to versions 0.2.1, 1.2.3 or later.

This module is the guts of nodejs-optimist's argument parser without all the fanciful decoration.

Security Fix(es):

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.(CVE-2020-7598)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.21.0).

Security Fix(es):

• nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

• nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or proto payload (CVE-2020-7598)

• nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.18.2).

Security Fix(es):

• nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

• nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or proto payload (CVE-2020-7598)

• nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)

• nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.21.0).

Security Fix(es):

• nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

• nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or proto payload (CVE-2020-7598)

• nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.18.2).

Security Fix(es):

• nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

• nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or proto payload (CVE-2020-7598)

• nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)

• nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

TuxCare rebuilt minimist to address 2 CVEs. Fixed in 0.0.10-tuxcare.1.

TuxCare rebuilt minimist to address 2 CVEs. Fixed in 1.2.8-tuxcare.1.

TuxCare rebuilt minimist to address 2 CVEs. Fixed in 0.0.8-tuxcare.1.

TuxCare rebuilt minimist to address 2 CVEs. Fixed in 1.2.0-tuxcare.1.

TuxCare rebuilt minimist to address 1 CVE. Fixed in 1.2.1-tuxcare.1.

TuxCare rebuilt minimist to address 2 CVEs. Fixed in 0.0.9-tuxcare.1.

TuxCare rebuilt minimist to address 2 CVEs. Fixed in 1.1.3-tuxcare.1.

This update for nodejs8 fixes the following issues:

• CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).
• CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).
• CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

This update was imported from the SUSE:SLE-15:Update update project.

Root has patched CVE-2020-7598 in the minimist package for Root:npm. Multiple fixed versions available.

This update fixes the following issues:

branch-network-formula:

• Handle application/efi mime type
• Allow http access to saltboot directory

cobbler:

• Signatures file now uses 'default_autoinstall' which fixes import problem happening with some distributions (bsc#1159010)
• Fix for kernel and initrd detection (bsc#1159010)

dhcpd-formula:

• UEFI HTTPBoot support
• Changed default of filename_efi to shim.efi for secure boot

grafana-formula:

• Add CaaSP datasource and dashboards

image-sync-formula:

• Install dosfstools package for sync_image_usb module to work

patterns-suse-manager:

• Require yast2-migration to allow online OS migrations (bsc#1167777)

prometheus-formula:

• Add meta-monitoring configuration
• Add federation configuration

pxe-formula:

• Add non-EFI grub menu variant
• Use /usr/lib64/efi/shim.efi path (workaround for bsc#1166523)
• Use grub2 variable 'prefix' instead of hardcoded /boot
• Prepare configuration for UEFI with Secure Boot
• Add support fot new terminal naming for UEFI network boot

py26-compat-salt:

• Do not make py26-compat-salt to require python-tornado on SLE15 (all SPs)
• Backport saltutil state module to 2016.11 codebase (bsc#1167556)
• Add new custom SUSE capability for saltutil state module

python-susemanager-retail:

• Fix retail_branch_init python error due to change in branch id handling

saltboot-formula:

• Add grain to force image redeployment and repartition
• Allow pillar customizable download urls Saltboot now recognizes following pillars:
  • saltboot_download_server: specifies from where download the images, kernel, etc.
  • saltboot_download_protocol: specifies what protocol to use for download
• Use more reliable progress output
• Python3 compatibility fix
• Use file.read instead of cp.get_file_str
• Improve image cache debug messages

spacewalk:

• Explicitly require postgresql10 package (bsc#1165926)

spacewalk-backend:

• Validate cached package entries on ISS slave (bsc#1159184)
• Do not break when syncing Oracle 7 yum channel (bsc#1158463)
• Always use the same RPM database when running 'spacewalk-repo-sync' from the command line or via taskomatic (bsc#1163468)

spacewalk-certs-tools:

• Add minion option in config file to disable salt mine when generated by bootstrap script (bsc#1163001)
• Disable modularity failsafe mechanism for RHEL 8 bootstrap repos (bsc#1164875)

spacewalk-client-tools:

• Use 'int' instead of 'long' on rhn_check for both Python 2 and 3
• Do not crash 'mgr-update-status' because 'long' type is not defined in Python 3
• Add workaround for uptime overflow to spacewalk-update-status as well (bsc#1165921)

spacewalk-java:

• Hide message about changed Update Tag change (bsc#1169109)
• Refresh pillar after channel change
• Use 'changes' field if 'pchanges' field doesn't exist (bsc#1159202)
• Fix the original-clone channel relationship for CLM channels (bsc#1163121)
• Fix serializer and documentation for system.listSystems (bsc#1168083)
• Skip and show migration targets which do not have a successor for all installed extension products (bsc#1168227)
• Fix resource leak in taskomatic (bsc#1168696)
• Add XMLRPC API method: proxy.listProxyClients (bsc#1166408)
• Hide Virtualization > Provisioning tab for Salt systems (bsc#1167329)
• Remove no longer necessary check for retail TERMINALS group membership
• Fix error when adding systems to ssm with 'add to ssm' button (bsc#1160246)
• Prevent build/promote on content projects which have build/promote in progress
• Clean stale Content Lifecycle targets on Tomcat startup (bsc#1164121)
• Show warning on products page when no SUSE Manager Server Subscription is available
• Improve performance for States view in SystemGroups detail view (bsc#1158752)
• Validate the suseproductchannel table and update missing date when running mgr-sync refresh (bsc#1163538)
• Add 'init.repo' kernel option to RHEL 8 kickstart tree (bsc#1163884)

spacewalk-utils:

• Check for delimiter as well when detecting…

This update for nodejs10 fixes the following issues:

nodejs10 was updated to version 10.21.0

• CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).
• CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).
• CVE-2020-10531: Fixed an integer overflow in UnicodeString:doAppend() (bsc#1166844).
• Fixed an issue with openssl by adding getrandom syscall definition for all Linux platforms (bsc#1162117).

npm was updated to 6.14.3

• CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

This update for nodejs10 fixes the following issues:

nodejs10 was updated to version 10.21.0

• CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).
• CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).
• CVE-2020-10531: Fixed an integer overflow in UnicodeString:doAppend() (bsc#1166844).

npm was updated to 6.14.3

• CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

This update for nodejs8 fixes the following issues:

• CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).
• CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).
• CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

This update for nodejs12 fixes the following issues:

nodejs12 was updated to version 12.18.0

• CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).
• CVE-2020-8172: Fixed am issue where TLS session reuse could have led to host certificate verification bypass (bsc#1172441).
• CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).

npm was updated to 6.13.6

• CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

This update for nodejs6 fixes the following issues:

• CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).
• CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

This update for nodejs8 fixes the following issues:

• CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).
• CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442).
• CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916)
• CVE-2020-15095: Fixed information leak through log files (bsc#1173937).
• Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686).
• Add Require for nodejs8 when intalling npm8 (bsc#1172728)