PT-2020-14322 · Webpack · Webpack-Subresource-Integrity

Jahed · Published 2020-10-19 · Updated 2021-11-18 · CVE-2020-15262

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions webpack-subresource-integrity versions prior to 1.5.1

Description The issue affects dynamically loaded chunks, which receive an invalid integrity hash that is ignored by the browser. This removes the additional level of protection offered by Subresource Integrity (SRI) for such chunks. Top-level chunks are unaffected.

Recommendations For versions prior to 1.5.1, update to version 1.5.1 to resolve the issue. As a temporary workaround, consider restricting the use of dynamically loaded chunks until the update is applied.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2020-15262

GHSA-4FC4-CHG7-H8GH

Affected Products

Webpack-Subresource-Integrity

References · 8

• https://github.com/waysact/webpack-subresource-integrity/commit/3d7090c08c333fcfb10ad9e2d6cf72e2acb7d87f · Patch
• https://osv.dev/vulnerability/GHSA-4fc4-chg7-h8gh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15262 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15262 · Vendor Advisory
• https://github.com/waysact/webpack-subresource-integrity/security/advisories/GHSA-4fc4-chg7-h8gh · Note
• https://github.com/waysact/webpack-subresource-integrity/issues/131 · Note
• https://github.com/waysact/webpack-subresource-integrity · Note
• https://t.me/cibsecurity/15396 · Telegram Post