PT-2019-14825 · Npm+1 · Serialize-Javascript+1

Redonkulus · Publicado 2019-12-05 · Atualizado 2020-03-13 · CVE-2019-16769

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions serialize-javascript versions prior to 2.1.1

Description The issue concerns a failure to properly mitigate against unsafe characters in serialized regular expressions, leading to Cross-site Scripting (XSS). This problem does not affect Node.js applications due to Node.js's implementation of RegExp.prototype.toString(), which backslash-escapes all forward slashes in regular expressions. The vulnerability is relevant when serialized data of regular expression objects are used in environments other than Node.js.

Recommendations For versions prior to 2.1.1, upgrade to version 2.1.1 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-16769

GHSA-H9RV-JMMF-4PGX

RHSA-2020:2796

SUSE-RU-2020:0671-1

SUSE-SU-2020:0671-1

Produtos afetados

Suse

Serialize-Javascript

Referências · 67

• https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx · Nota
• https://bugzilla.suse.com/1160940 · Nota
• https://bugzilla.suse.com/1162683 · Nota
• https://bugzilla.suse.com/1157317 · Nota
• https://bugzilla.suse.com/1166388 · Nota
• https://github.com/advisories/GHSA-h9rv-jmmf-4pgx · Nota
• https://osv.dev/vulnerability/GHSA-h9rv-jmmf-4pgx · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-RU-2020:0671-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1166061 · Nota
• https://bugzilla.suse.com/1154246 · Nota
• https://bugzilla.suse.com/1165541 · Nota
• https://bugzilla.suse.com/1152673 · Nota
• https://bugzilla.suse.com/1160184 · Nota
• https://bugzilla.suse.com/1153269 · Nota
• https://bugzilla.suse.com/1123274 · Nota