CVE-2019-10747
Fixed in a distro release EPSS 2%
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.
Products: set-value_project set-value
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | set-value | 2.0.1 |
| npm | set-value | 3.0.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2224+b07ac28e |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2521+c668cc9f |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| Debian 12 | node-set-value | 0.4.0-2 |
| Debian 13 | node-set-value | 0.4.0-2 |
| Debian 14 | node-set-value | 0.4.0-2 |
| Red Hat Enterprise Linux 8 | nodejs | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:2.0.3-1.module+el8.3.0+9715+1718613f |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat Enterprise Linux 8 | npm | 1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs | 0:12.20.1-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-debuginfo | 0:12.20.1-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-devel | 0:12.20.1-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-docs | 0:12.20.1-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-nodemon | 0:2.0.3-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-npm | 0:6.14.10-12.20.1.1.el7 |
| Rocky Linux 8 | nodejs-nodemon | 0:2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| Rocky Linux 8 | nodejs-nodemon | 0:2.0.3-1.module+el8.3.0+100+234774f7 |
| Rocky Linux 8 | nodejs-nodemon | 0:2.0.3-1.module+el8.4.0+638+5344c6f7 |
| Rocky Linux 8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 |
| Ubuntu 18.04 LTS | node-set-value | no fix |