PT-2022-9007 · Hoek · Hoek

Published 2022-09-23 · Updated 2022-09-26 · CVE-2020-36604

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions hoek versions prior to 8.5.1 hoek versions 9.x prior to 9.0.3

Description The issue allows prototype poisoning in the clone function. If an object with the proto key is passed to clone(), the key is converted to a prototype.

Recommendations For hoek versions prior to 8.5.1, update to version 8.5.1 to resolve the issue. For hoek versions 9.x prior to 9.0.3, update to version 9.0.3 to resolve the issue. As a temporary workaround, consider avoiding the use of the clone() function with objects containing the proto key until a patch is applied.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2020-36604

GHSA-C429-5P7V-VGJP

Affected Products

Hoek

References · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36604 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36604 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36604 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-36604 · Security Note
• https://osv.dev/vulnerability/GHSA-c429-5p7v-vgjp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36604 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-36604 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36604 · Vendor Advisory
• https://github.com/hapijs/hoek/issues/352 · Note
• https://github.com/hapijs/hoek/commit/4d0804bc6135ad72afdc5e1ec002b935b2f5216a · Note
• https://github.com/hapijs/hoek/commit/948baf98634a5c206875b67d11368f133034fa90 · Note
• https://t.me/cibsecurity/50304 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452) · Note
• https://t.me/cvenotify/36742 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452%29 · Note