PT-2023-21600 · Webpack+3 · Webpack+3

Jack-Works · Published 2023-03-13 · Updated 2024-07-05 · CVE-2023-28154

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Webpack versions prior to 5.76.0

Description The issue concerns cross-realm object access. Specifically, the ImportParserPlugin.js mishandles the magic comment feature, allowing an attacker who controls a property of an untrusted object to obtain access to the real global object.

Recommendations For Webpack versions prior to 5.76.0, update to version 5.76.0 or later to resolve the issue.

Fix

Related Identifiers

ALSA-2023:1591

ALSA-2023:2652

CVE-2023-28154

GHSA-HC6Q-2MPP-QW7J

OPENSUSE-SU-2024:12803-1

OPENSUSE-SU-2024:12979-1

OPENSUSE-SU-2024:14106-1

RHSA-2023:1591

RHSA-2023_1591

RLSA-2023:1591

Affected Products

Almalinux

Red Hat

Rocky Linux

Webpack

References · 42

• https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0 · Patch
• https://github.com/webpack/webpack/pull/16500 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-28154 · Security Note
• https://osv.dev/vulnerability/GHSA-hc6q-2mpp-qw7j · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12803-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28154 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-28154 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AU7BOXTBK3KDYSWH67ASZ22TUIOZ3X5G · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AU7BOXTBK3KDYSWH67ASZ22TUIOZ3X5G · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12979-1 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-1591.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PPSAXUTXBCCTAHTCX5BUR4YVP25XALQ3 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/U2AFCM6FFE3LRYI6KNEQWKMXMQOBZQ2D · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:1591 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28154 · Vendor Advisory