PT-2019-12022 · Npm+4 · Mixin-Deep+4

Published 2019-08-23 · Updated 2022-10-29 · CVE-2019-10746

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mixin-deep versions prior to 1.3.2 mixin-deep versions prior to 2.0.1

Description The issue concerns Prototype Pollution, where the mixin-deep function can be tricked into adding or modifying properties of Object.prototype using a constructor payload. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. The mixinDeep function fails to validate which Object properties it updates.

Recommendations If you are using mixin-deep 2.x, upgrade to version 2.0.1 or later. If you are using mixin-deep 1.x, upgrade to version 1.3.2 or later.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

ALSA-2021:0549

CESA-2021_0549

CVE-2019-10746

GHSA-FHJF-83WG-R2J9

RHSA-2021:0485

RHSA-2021:0549

RHSA-2021_0549

RLSA-2021:0549

SNYK-JS-MIXINDEEP-450212

Affected Products

Almalinux

Centos

Red Hat

Rocky Linux

Mixin-Deep

References · 35

• 🔥 https://snyk.io/vuln/SNYK-JS-MIXINDEEP-450212 · Exploit
• https://errata.almalinux.org/8/ALSA-2021-0549.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:0549 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10746 · Security Note
• https://osv.dev/vulnerability/GHSA-fhjf-83wg-r2j9 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFNIVG2XYFPZJY3DYYBJASZ7ZMKBMIJT · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10746 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10746 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXRA365KZCUNXMU3KDH5JN5BEPNIGUKC · Vendor Advisory
• https://oracle.com//security-alerts/cpujul2021.html · Patch
• https://ubuntu.com/security/CVE-2019-10746 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10746 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UXRA365KZCUNXMU3KDH5JN5BEPNIGUKC · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:0549 · Vendor Advisory