CVE-2019-11358

Fixed in a distro release EPSS 87%

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

Published 2019-04-19 · CVE record · OSV

Products: jquery, debian_linux, drupal, backdropcms backdrop, fedoraproject fedora, opensuse backports_sle, opensuse leap, netapp oncommand_system_manager, netapp snapcenter, redhat cloudforms, redhat virtualization_manager, oracle agile_product_lifecycle_management_for_process, oracle application_express, oracle application_service_level_management, oracle application_testing_suite, oracle banking_digital_experience, oracle banking_enterprise_collections, oracle banking_platform, oracle bi_publisher, oracle big_data_discovery, oracle business_process_management_suite, oracle communications_analytics, oracle communications_application_session_controller, oracle communications_billing_and_revenue_management, oracle communications_diameter_signaling_router, oracle communications_eagle_application_processor, oracle communications_element_manager, oracle communications_interactive_session_recorder, oracle communications_operations_monitor, oracle communications_services_gatekeeper, oracle communications_session_report_manager, oracle communications_session_route_manager, oracle communications_unified_inventory_management, oracle communications_webrtc_session_controller, oracle diagnostic_assistant, oracle enterprise_manager_ops_center, oracle enterprise_session_border_controller, oracle financial_services_analytical_applications_infrastructure, oracle financial_services_analytical_applications_reconciliation_framework, oracle financial_services_asset_liability_management, oracle financial_services_balance_sheet_planning, oracle financial_services_basel_regulatory_capital_basic, oracle financial_services_basel_regulatory_capital_internal_ratings_based_approach, oracle financial_services_data_foundation, oracle financial_services_data_governance_for_us_regulatory_reporting, oracle financial_services_data_integration_hub, oracle financial_services_enterprise_financial_performance_analytics, oracle financial_services_funds_transfer_pricing, oracle financial_services_hedge_management_and_ifrs_valuations, oracle financial_services_institutional_performance_analytics, oracle financial_services_liquidity_risk_management, oracle financial_services_liquidity_risk_measurement_and_management, oracle financial_services_loan_loss_forecasting_and_provisioning, oracle financial_services_market_risk_measurement_and_management, oracle financial_services_price_creation_and_discovery, oracle financial_services_profitability_management, oracle financial_services_regulatory_reporting_for_de_nederlandsche_bank, oracle financial_services_regulatory_reporting_for_european_banking_authority, oracle financial_services_regulatory_reporting_for_us_federal_reserve, oracle financial_services_retail_customer_analytics, oracle financial_services_retail_performance_analytics, oracle financial_services_revenue_management_and_billing, oracle fusion_middleware_mapviewer, oracle healthcare_foundation, oracle healthcare_translational_research, oracle hospitality_guest_access, oracle hospitality_materials_control, oracle hospitality_simphony, oracle identity_manager, oracle insurance_accounting_analyzer, oracle insurance_allocation_manager_for_enterprise_profitability, oracle insurance_data_foundation, oracle insurance_ifrs_17_analyzer, oracle insurance_insbridge_rating_and_underwriting, oracle insurance_performance_insight, oracle jd_edwards_enterpriseone_tools, oracle jdeveloper, oracle jdeveloper_and_adf, oracle knowledge, oracle peoplesoft_enterprise_peopletools, oracle policy_automation, oracle policy_automation_connector_for_siebel, oracle policy_automation_for_mobile_devices, oracle primavera_gateway, oracle primavera_unifier, oracle real-time_scheduler, oracle rest_data_services, oracle retail_back_office, oracle retail_central_office, oracle retail_customer_insights, oracle retail_customer_management_and_segmentation_foundation, oracle retail_point-of-service, oracle retail_returns_management, oracle service_bus, oracle siebel_mobile_applications, oracle siebel_ui_framework, oracle storagetek_tape_analytics_sw_tool, oracle system_utilities, oracle tape_library_acsls, oracle transportation_management, oracle utilities_mobile_workforce_management, oracle webcenter_sites, oracle weblogic_server, joomla, juniper junos

Fixed upstream

Distro releases