REDHAT-BUG-2477210: High severity vm2 vm2 vulnerability
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.3
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477210?
The severity of REDHAT-BUG-2477210 is classified as high with a rating of 7.
How do I fix REDHAT-BUG-2477210?
To address REDHAT-BUG-2477210, upgrade vm2 to version 3.11.3 or later.
What is the nature of the vulnerability in REDHAT-BUG-2477210?
REDHAT-BUG-2477210 allows the catching of host exceptions using the yield* expression in async generators.
What versions of vm2 are affected by REDHAT-BUG-2477210?
Versions prior to 3.11.3 of vm2 are affected by REDHAT-BUG-2477210.
Is REDHAT-BUG-2477210 a known issue in the Node.js ecosystem?
Yes, REDHAT-BUG-2477210 has been identified as a vulnerability in the Node.js ecosystem involving the vm2 package.