{"id":"CVE-2020-28477","aliases":["EUVD-2021-0500","GHSA-9qmh-276g-x5pj","RHSA-2021:1169","ROOT-APP-NPM-CVE-2020-28477","SUSE-SU-2021:0906-1"],"status":"published","title":"Prototype Pollution","description":"This affects all versions of package immer.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02341,"percentile":0.83738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-471"],"published":"2021-01-19T10:20:13Z","modified":"2026-10-24T10:30:33Z","fixes":[{"ecosystem":"npm","package":"immer","fixed_in":["8.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"immer","fixed_in":["8.0.1-aikido.1","8.0.1-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/immer","fixed_in":["8.0.1-root.io.1","8.0.1-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"immer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.0.1"}]}]},{"source":"osv","ecosystem":"npm","package":"immer","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"8.0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-dbscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-health-check-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-restapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-cinderlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-imageio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-ovirt-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-ovirt-engine-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-vmconsole-proxy-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-tools-backup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-vmconsole-proxy-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-webadmin-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"python3-ovirt-engine-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"rhvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.5.9-0.1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:npm","package":"immer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-aikido.1"},{"fixed":"8.0.1-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/immer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-root.io.1"},{"fixed":"8.0.1-root.io.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5-2.9.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-4.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-4.22.7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-4.12.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.4-3.9.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-proxy-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.6-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.23-3.18.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0+git20190806.32c4bae0-5.6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"mgr-libmod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7-3.16.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5-2.9.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-3.19.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-6.11.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-4.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"smdba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-0.3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-4.22.7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-4.12.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.30-3.31.7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.14-3.12.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.23-3.18.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.24-3.20.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.28.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.28.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.19-3.24.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-3.26.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"xpp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4c-11.2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15-3.5.2"}]}],"bundled":4}],"products":[{"vendor":"immer_project","product":"immer"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-IMMER-1019369","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","article"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1061986","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/immerjs/immer/blob/master/src/plugins/patches.ts%23L213","tags":["x_refsource_MISC","x_transferred","Broken Link","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28477","tags":["advisory"]},{"url":"https://github.com/immerjs/immer/issues/738","tags":["web"]},{"url":"https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5","tags":["web"]},{"url":"https://www.npmjs.com/package/immer","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9qmh-276g-x5pj"},{"url":"https://access.redhat.com/errata/RHSA-2021:1169","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1145658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1155275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1649479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1688186","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1729359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1787235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1802844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1837221","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1843882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1858420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1882273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1884233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1889823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1895217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901752","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1905108","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1905158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1908441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1910302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1913198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1914602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1918162","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1922200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1924012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1926854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1927851","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931514","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931786","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1169.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-20921","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20921","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20921","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9r7h-6639-v5mw","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-BOOTSTRAPSELECT-570457","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-25657","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25657","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25657","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28458","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28458","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1016402","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28477","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28477","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210906-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1157711","tags":["report"]},{"url":"https://bugzilla.suse.com/1173893","tags":["report"]},{"url":"https://bugzilla.suse.com/1175660","tags":["report"]},{"url":"https://bugzilla.suse.com/1177508","tags":["report"]},{"url":"https://bugzilla.suse.com/1179579","tags":["report"]},{"url":"https://bugzilla.suse.com/1180145","tags":["report"]},{"url":"https://bugzilla.suse.com/1180146","tags":["report"]},{"url":"https://bugzilla.suse.com/1180224","tags":["report"]},{"url":"https://bugzilla.suse.com/1180439","tags":["report"]},{"url":"https://bugzilla.suse.com/1180547","tags":["report"]},{"url":"https://bugzilla.suse.com/1180558","tags":["report"]},{"url":"https://bugzilla.suse.com/1180757","tags":["report"]},{"url":"https://bugzilla.suse.com/1180994","tags":["report"]},{"url":"https://bugzilla.suse.com/1181048","tags":["report"]},{"url":"https://bugzilla.suse.com/1181165","tags":["report"]},{"url":"https://bugzilla.suse.com/1181228","tags":["report"]},{"url":"https://bugzilla.suse.com/1181290","tags":["report"]},{"url":"https://bugzilla.suse.com/1181416","tags":["report"]},{"url":"https://bugzilla.suse.com/1181423","tags":["report"]},{"url":"https://bugzilla.suse.com/1181635","tags":["report"]},{"url":"https://bugzilla.suse.com/1181807","tags":["report"]},{"url":"https://bugzilla.suse.com/1181814","tags":["report"]},{"url":"https://bugzilla.suse.com/1182001","tags":["report"]},{"url":"https://bugzilla.suse.com/1182006","tags":["report"]},{"url":"https://bugzilla.suse.com/1182008","tags":["report"]},{"url":"https://bugzilla.suse.com/1182071","tags":["report"]},{"url":"https://bugzilla.suse.com/1182200","tags":["report"]},{"url":"https://bugzilla.suse.com/1182492","tags":["report"]},{"url":"https://bugzilla.suse.com/1182685","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28477","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-28477","title":"Prototype Pollution","description":"This affects all versions of package immer.","status":"published","published":"2021-01-19T10:20:13.022Z","modified":"2024-09-17T04:25:21.993Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:57.017407Z"}],"euvd":[{"id":"EUVD-2021-0500","description":"This affects all versions of package immer.","status":"published","published":"2021-01-19T10:20:13Z","modified":"2024-09-17T04:25:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C","level":"high"}],"updated_at":"2026-11-03T00:28:23.116921Z"}],"ghsa":[{"id":"GHSA-9qmh-276g-x5pj","title":"Prototype Pollution in immer","description":"## Overview\n\nAffected versions of immer are vulnerable to Prototype Pollution.\n\n## Proof of exploit\n\n```js\nconst {applyPatches, enablePatches} = require(\"immer\");\nenablePatches();\nlet obj = {};\nconsole.log(\"Before : \" + obj.polluted);\napplyPatches({}, [ { op: 'add', path: [ \"__proto__\", \"polluted\" ], value: \"yes\" } ]);\n// applyPatches({}, [ { op: 'replace', path: [ \"__proto__\", \"polluted\" ], value: \"yes\" } ]);\nconsole.log(\"After : \" + obj.polluted);\n```\n\n## Remediation\n\nVersion 8.0.1 contains a [fix](https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5) for this vulnerability, updating is recommended.","status":"published","published":"2021-01-20T21:27:56Z","modified":"2024-04-25T22:17:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-471"],"updated_at":"2026-11-02T14:37:47.338362Z"}],"nvd":[{"id":"CVE-2020-28477","description":"This affects all versions of package immer.","status":"published","published":"2021-01-19T11:15:13.167Z","modified":"2026-06-17T03:10:30.933Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:30.596418Z"}],"osv":[{"id":"CVE-2020-28477","description":"This affects all versions of package immer.","status":"published","published":"2021-01-19T11:15:13.167Z","modified":"2026-10-24T10:30:33.650570813Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"GHSA-9qmh-276g-x5pj","title":"Prototype Pollution in immer","description":"## Overview\n\nAffected versions of immer are vulnerable to Prototype Pollution.\n\n## Proof of exploit\n\n```js\nconst {applyPatches, enablePatches} = require(\"immer\");\nenablePatches();\nlet obj = {};\nconsole.log(\"Before : \" + obj.polluted);\napplyPatches({}, [ { op: 'add', path: [ \"__proto__\", \"polluted\" ], value: \"yes\" } ]);\n// applyPatches({}, [ { op: 'replace', path: [ \"__proto__\", \"polluted\" ], value: \"yes\" } ]);\nconsole.log(\"After : \" + obj.polluted);\n```\n\n## Remediation\n\nVersion 8.0.1 contains a [fix](https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5) for this vulnerability, updating is recommended.","status":"published","published":"2021-01-20T21:27:56Z","modified":"2025-01-14T08:57:00.11013Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-471"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"RHSA-2021:1169","title":"Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] security, bug fix, enhancement","status":"published","published":"2024-09-16T05:20:39Z","modified":"2026-02-24T10:04:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"ROOT-APP-NPM-CVE-2020-28477","title":"CVE-2020-28477 in immer - Patched by Root","description":"Root has patched CVE-2020-28477 in the immer package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-02T06:57:26Z","modified":"2026-09-02T08:00:04.262993493Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"SUSE-SU-2021:0906-1","title":"Security update for SUSE Manager Server 4.1","description":"This update fixes the following issues:\n\ncobbler:\n\n- Fix string replacement for @@xyz@@\n- Better performing string replacements\n\ngrafana-formula:\n\n- Set `supported` to false for unsupported systems (bsc#1182001)\n- Add SLES 15 SP3 and openSUSE Leap 15.3 to supported versions\n\nmgr-libmod:\n\n- Fix 'list_modules' JSON serialization (bsc#1182492)\n\nmgr-osad:\n\n- Adapt to new SSL implementation of rhnlib (bsc#1181807)\n\nprometheus-exporters-formula:\n\n- Add Ubuntu support for Prometheus exporters' reverse proxy\n\nprometheus-formula:\n\n- Set server hostname from pillar data (bsc#1180439)\n\npy26-compat-salt:\n\n- Do not crash when unexpected cmd output at listing patches (bsc#1181290)\n\nrhnlib:\n\n- Change SSL implementation to python ssl for better SAN and\n  hostname matching support (bsc#1181807)\n\nsmdba:\n\n- Do not remove the database if there is no backup and deal with manifest\n\nspacewalk-backend:\n\n- Open repomd files as binary (bsc#1173893)\n- Fix requesting Release file in debian repos (bsc#1182006)\n- Reposync: Fixed Kickstart functionality.\n- Reposync: Fixed URLGrabber error handling.\n- Reposync: Fix modular data handling for cloned channels (bsc#1177508)\n\nspacewalk-client-tools:\n\n- Adapt to new SSL implementation of rhnlib (bsc#1181807)\n\nspacewalk-config:\n\n- Increase apache ssl logs to include response code and process time\n\nspacewalk-java:\n\n- Homogenizes style in filter buttons, facilitating testability\n- Cleanup sessions via SQL query instead of SQL function (bsc#1180224)\n- Rebuild and improve rendering of error pages 404 and 500 pages (bsc#1181228)\n- Fix user creation with pam auth and no password (bsc#1179579)\n- Fix action chains for saltssh minions (bsc#1182200)\n- FIX: Slow response of 'Software \u003e Install' in Ubuntu minions (bsc#1181165)\n- Do not call page decorator in HEAD requests (bsc#1181228)\n- Add 'mgr_origin_server' to Salt pillar data (bsc#1180439)\n- Ensure new files are synced just after writing them (bsc#1175660)\n- Enable openscap auditing for salt systems in SSM (bsc#1157711)\n- Detect debian products (bsc#1181416)\n- Show packages from channels assigned to the targeted system (bsc#1181423)\n- Add an API endpoint to allow/disallow scheduling irrelevant patches (bsc#1180757)\n- Open raw output in new tab for ScriptRunAction (bsc#1180547)\n- Default to preferred items per page in content lifecycle lists (bsc#1180558)\n- Fix modular data handling for cloned channels (bsc#1177508)\n- Fix: login gets an ISE when SSO is enabled (bsc#1181048)\n\nspacewalk-utils:\n\n- Fix modular data handling for cloned channels (bsc#1177508)\n\nspacewalk-web:\n\n- Replace CRLF in ssh priv key when bootstrapping (bsc#1182685)\n- Upgrade immer to fix CVE-2020-28477\n- Default to preferred items per page in content lifecycle lists (bsc#1180558)\n- Fix sorting in content lifecycle projects and cluster tables (bsc#1180558)\n\nsusemanager:\n\n- Add SLE 15 SP3 bootstrap repository definitions (bsc#1182008)\n- Python3-dbus-python and dependencies not installed by default\n  on JeOS SLE15 images, add them to the bootstrap repository list\n  of packages for traditional (bsc#1182071)\n\nsusemanager-doc-indexes:\n\n- Updated Command Line Registration with Salt section in the Client\n  Configuration Guide for clarity.\n- Adds openSUSE Leap SP migration to the SP migration section of the Client\n  Configuration Guide\n- Adds note that bootstrap procedure for selecting a parent\n  channel is optional in Client Configuration Guide (bsc#1181635)\n- Adds note about checking for valid UUIDs in fstab\n  when backing up (bsc#1181814)\n- Updated command for running configure proxy script when replacing a proxy\n- Fixed bad SUSE Customer Center URL\n\nsusemanager-docs_en:\n\n- Updated Command Line Registration with Salt section in the Client\n  Configuration Guide for clarity.\n- Adds openSUSE Leap SP migration to the SP migration section of the Client\n  Configuration Guide\n- Adds note that bootstrap procedure for selecting a parent\n  channel is optional in Client Configuration Guide (bsc#1181635)\n- Adds note about checking for valid UUIDs in fstab\n  when backing up (bsc#1181814)\n- Updated command for running configure proxy script when replacing a proxy\n- Fixed bad SUSE Customer Center URL\n\nsusemanager-schema:\n\n- Drop 'pxt_session_cleanup' function (bsc#1180224)\n- Enable openscap auditing for salt systems in SSM (bsc#1157711)\n\nsusemanager-sls:\n\n- Ubuntu 18 has version of apt which does not correctly support\n  auth.conf.d directory. Detect the working version and use this feature\n  only when we have a higher version installed\n\nxstream:\n\nUpgrade to 1.4.15\n\n- fixes bsc#1180146, CVE-2020-26258 and bsc#1180145, CVE-2020-26259\n- fixes bsc#1180994, CVE-2020-26217\n\nsubscription-matcher:\n\n- Update the xstream dependency to 1.4.15\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2021-03-19T15:18:39Z","modified":"2026-02-04T02:16:30.339534Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}