REDHAT-BUG-2477100: High severity protobufjs vulnerability
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 7.5.6 - Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477100?
The severity of REDHAT-BUG-2477100 is classified as high with a rating of 7.
How do I fix REDHAT-BUG-2477100?
To fix REDHAT-BUG-2477100, upgrade to protobufjs version 7.5.6 or later, or version 8.0.2 or later.
What vulnerabilities are associated with REDHAT-BUG-2477100?
REDHAT-BUG-2477100 involves vulnerabilities in protobufjs that allow schema option paths to improperly traverse inherited object properties.
What versions of protobufjs are affected by REDHAT-BUG-2477100?
Versions of protobufjs prior to 7.5.6 and 8.0.2 are affected by REDHAT-BUG-2477100.
What is the impact of the vulnerability REDHAT-BUG-2477100?
The impact of REDHAT-BUG-2477100 could allow the execution of unintended option handling through crafted protobuf schemas or JSON descriptors.