PT-2020-19727 · Linux · Linux-Cmdline

Nerdjs · Published 2020-08-17 · Updated 2022-12-02 · CVE-2020-7704

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions linux-cmdline versions prior to 1.0.1

Description The issue concerns Prototype Pollution via the constructor in a package that parses Linux kernel command line arguments.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue.

Exploit

Fix

Prototype Pollution

RCE

Weakness Enumeration

CWE-1321

CWE-20

Related Identifiers

CVE-2020-7704

GHSA-2C29-WC65-4CX9

SNYK-JS-LINUXCMDLINE-598674

Affected Products

Linux-Cmdline

References · 6

• 🔥 https://snyk.io/vuln/SNYK-JS-LINUXCMDLINE-598674 · Exploit
• https://github.com/piranna/linux-cmdline/commit/53c61a88bc47eb25d71832205056beaab95cf677 · Patch
• https://osv.dev/vulnerability/CVE-2020-7704 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2c29-wc65-4cx9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7704 · Security Note
• https://github.com/piranna/linux-cmdline · Note