REDHAT-BUG-2459442: High severity protobufjs vulnerability
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 8.0.1 - Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 7.5.5
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2459442?
The severity of REDHAT-BUG-2459442 is rated as high with a score of 7.
How do I fix REDHAT-BUG-2459442?
To fix REDHAT-BUG-2459442, upgrade to protobufjs version 8.0.1 or 7.5.5 or later.
What vulnerability is associated with REDHAT-BUG-2459442?
REDHAT-BUG-2459442 allows attackers to inject arbitrary code through the 'type' fields of protobuf definitions.
Which versions of protobufjs are affected by REDHAT-BUG-2459442?
Versions prior to 8.0.1 and 7.5.5 of protobufjs are affected by REDHAT-BUG-2459442.
What is the impact of REDHAT-BUG-2459442?
The impact of REDHAT-BUG-2459442 is the potential execution of arbitrary code during object decoding.