CVE-2020-7774

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Overview

The npm package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution.

POC

const y18n = require('y18n')();

y18n.setLocale('__proto__');
y18n.updateLocale({polluted: true});

console.log(polluted); // true

Recommendation

Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.(CVE-2020-15095)

This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require( y18n )(); y18n.setLocale( proto ); y18n.updateLocale({polluted: true}); console.log(polluted); // true(CVE-2020-7774)

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.(CVE-2020-7754)

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.(CVE-2020-7788)

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ( Prototype Pollution )(CVE-2021-3918)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

• c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)

• nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.23.1).

Security Fix(es):

• libuv: buffer overflow in realpath (CVE-2020-8252)

• nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

• nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

• nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

• nodejs-dot-prop: prototype pollution (CVE-2020-8116)

• nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

• npm: sensitive information exposure through logs (CVE-2020-15095)

• nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

• nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

• nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.15.4).

Security Fix(es):

• nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

• nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

• nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

• nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

• c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)

• nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

• nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• yarn install crashes with nodejs:14 on aarch64 (BZ#1916465)

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

• c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)

• nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.23.1).

Security Fix(es):

• libuv: buffer overflow in realpath (CVE-2020-8252)

• nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

• nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

• nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

• nodejs-dot-prop: prototype pollution (CVE-2020-8116)

• nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

• npm: sensitive information exposure through logs (CVE-2020-15095)

• nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

• nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

• nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.15.4).

Security Fix(es):

• nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

• nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

• nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

• nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

• c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)

• nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

• nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• yarn install crashes with nodejs:14 on aarch64 (BZ#1916465)

TuxCare rebuilt y18n to address 1 CVE. Fixed in 4.0.0-tuxcare.1.

This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('proto'); y18n.updateLocale({polluted: true}); console.log(polluted); // true (CVE-2020-7774).

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity (CVE-2021-23362).

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option (CVE-2021-27290).

Theses issues are fixed by upgrading nodejs packages to latest available LTS 14.17.3 version. See upstream releases notes for other included bugfixes.

This update for nodejs12 fixes the following issues:

• update to 12.22.2:
• CVE-2021-22918: Out of bounds read (bsc#1187973)
• CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)
• CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)
• CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
• CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
• CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for nodejs14 fixes the following issues:

Update nodejs14 to 14.17.2.

Including fixes for:

• CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
• CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
• CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
• CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for nodejs10 fixes the following issues:

Update nodejs10 to 10.24.1.

Including fixes for

• CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
• CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
• CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
• CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
• CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
• CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
• reduce memory footprint of test-worker-stdio (bsc#1183155)

This update was imported from the SUSE:SLE-15:Update update project.

This update for nodejs8 fixes the following issues:

• update to npm 6.14.13
• CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)
• CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. (bsc#1187977)
• CVE-2020-7774: fixes y18n Prototype Pollution. (bsc#1184450)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for nodejs12 fixes the following issues:

• update to 12.22.2:
• CVE-2021-22918: Out of bounds read (bsc#1187973)
• CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)
• CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)
• CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
• CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
• CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)

This update for nodejs10 fixes the following issues:

Update nodejs10 to 10.24.1.

Including fixes for

• CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
• CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
• CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
• CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
• CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
• CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
• reduce memory footprint of test-worker-stdio (bsc#1183155)

This update for nodejs14 fixes the following issues:

Update nodejs14 to 14.17.2.

Including fixes for:

• CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
• CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
• CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
• CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)

This update for nodejs8 fixes the following issues:

• update to npm 6.14.13
• CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)
• CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. (bsc#1187977)
• CVE-2020-7774: fixes y18n Prototype Pollution. (bsc#1184450)

These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2020-7774 in the y18n package for Root:npm. Multiple fixed versions available.

This update for nodejs14 fixes the following issues:

Update nodejs14 to 14.17.2.

Including fixes for:

• CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
• CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
• CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
• CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)

This update for nodejs10 fixes the following issues:

Update nodejs10 to 10.24.1.

Including fixes for

• CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
• CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
• CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
• CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
• CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
• CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)

This update for nodejs12 fixes the following issues:

• update to 12.22.2:
• CVE-2021-22918: Out of bounds read (bsc#1187973)
• CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)
• CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)
• CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
• CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
• CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)

This update for nodejs12 fixes the following issues:

• update to 12.22.2:
• CVE-2021-22918: Out of bounds read (bsc#1187973)
• CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)
• CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)
• CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
• CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
• CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)

This update for nodejs10 fixes the following issues:

Update nodejs10 to 10.24.1.

Including fixes for

• CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
• CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
• CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
• CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
• CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
• CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
• reduce memory footprint of test-worker-stdio (bsc#1183155)

This update for nodejs14 fixes the following issues:

Update nodejs14 to 14.17.2.

Including fixes for:

• CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
• CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
• CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
• CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)

This update for nodejs8 fixes the following issues:

• update to npm 6.14.13
• CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)
• CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. (bsc#1187977)
• CVE-2020-7774: fixes y18n Prototype Pollution. (bsc#1184450)

This update for nodejs8 fixes the following issues:

• update to npm 6.14.13
• CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)
• CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service (bsc#1187977)
• CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)