REDHAT-BUG-2477088: High severity protobufjs vulnerability
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the proto key. If an application constructed a message from an attacker-controlled plain object, an own enumerable proto property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 7.5.6 - Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477088?
The severity of REDHAT-BUG-2477088 is classified as high, with a score of 7.
How do I fix REDHAT-BUG-2477088?
To mitigate REDHAT-BUG-2477088, upgrade protobufjs to version 7.5.6 or later, or to version 8.0.2 or later.
What are the risks associated with REDHAT-BUG-2477088?
The risks associated with REDHAT-BUG-2477088 include the potential for an attacker to exploit the vulnerability through crafted messages, leading to unauthorized property access.
Which versions of protobufjs are affected by REDHAT-BUG-2477088?
Versions prior to 7.5.6 and 8.0.2 of protobufjs are affected by REDHAT-BUG-2477088.
What is the impact of REDHAT-BUG-2477088 on applications?
The impact of REDHAT-BUG-2477088 on applications includes possible security breaches due to improper handling of prototype properties during message construction.