CVE-2021-23358
Fixed in a distro release EPSS 4%CVSS 3.3
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Products: underscorejs underscore, debian_linux, tenable.sc, fedoraproject fedora
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | underscore | 1.12.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | underscore | 1.9.1~dfsg-1+deb10u1 |
| Debian 12 | underscore | 1.9.1~dfsg-2 |
| Debian 13 | underscore | 1.9.1~dfsg-2 |
| Debian 14 | underscore | 1.9.1~dfsg-2 |
| Debian 9 | underscore | 1.8.3~dfsg-1+deb9u1 |
| Red Hat ceph storage 7.1 | ceph | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-base | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-base | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-base-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-base-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-common | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-common | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-common-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-common-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-debugsource | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-debugsource | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-exporter-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-exporter-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-fuse | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-fuse | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-fuse-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-fuse-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-immutable-object-cache | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-immutable-object-cache | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-immutable-object-cache-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-immutable-object-cache-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-mds-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-mds-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-mgr-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-mgr-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-mib | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-mib | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-mon-client-nvmeof-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-mon-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-mon-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-osd-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-osd-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-radosgw-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-radosgw-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-resource-agents | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-resource-agents | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-selinux | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-selinux | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | ceph-test-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | ceph-test-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | cephadm | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | cephfs-mirror-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | cephfs-mirror-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | cephfs-top | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | cephfs-top | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | libcephfs-devel | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | libcephfs-devel | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | libcephfs2 | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | libcephfs2 | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | libcephfs2-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | libcephfs2-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | libcephsqlite-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | libcephsqlite-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | librados-devel | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | librados-devel | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | librados-devel-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | librados-devel-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | librados2 | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | librados2 | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | librados2-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | librados2-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | libradospp-devel | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | libradospp-devel | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | libradosstriper1 | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | libradosstriper1 | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | libradosstriper1-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | libradosstriper1-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | librbd-devel | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | librbd-devel | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | librbd1 | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | librbd1 | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | librbd1-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | librbd1-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | librgw-devel | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | librgw-devel | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | librgw2 | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | librgw2 | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | librgw2-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | librgw2-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | python3-ceph-argparse | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | python3-ceph-argparse | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | python3-ceph-common | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | python3-ceph-common | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | python3-cephfs | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | python3-cephfs | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | python3-cephfs-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | python3-cephfs-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | python3-rados | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | python3-rados | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | python3-rados-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | python3-rados-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | python3-rbd | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | python3-rbd | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | python3-rbd-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | python3-rbd-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | python3-rgw | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | python3-rgw | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | python3-rgw-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | python3-rgw-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | rbd-fuse-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | rbd-fuse-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | rbd-mirror-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | rbd-mirror-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | rbd-nbd | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | rbd-nbd | 2:18.2.1-381.el9cp |
| Red Hat ceph storage 7.1 | rbd-nbd-debuginfo | 2:18.2.1-381.el8cp |
| Red Hat ceph storage 7.1 | rbd-nbd-debuginfo | 2:18.2.1-381.el9cp |
| Red Hat rhev manager 4.4 el8 | ovirt-engine | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-backend | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-dbscripts | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-health-check-bundler | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-restapi | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-base | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-cinderlib | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-imageio | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-ovirt-engine | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-ovirt-engine-common | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-vmconsole-proxy-helper | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-websocket-proxy | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-tools | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-tools-backup | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-ui-extensions | 0:1.2.7-1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-ui-extensions | 0:1.3.5-1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-vmconsole-proxy-helper | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-webadmin-portal | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-websocket-proxy | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-log-collector | 0:4.4.7-2.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-web-ui | 0:1.9.1-1.el8ev |
| Red Hat rhev manager 4.4 el8 | python3-ovirt-engine-lib | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | rhvm | 0:4.5.2.4-0.1.el8ev |
| Ubuntu 16.04 LTS | underscore | 1.7.0~dfsg-1ubuntu1.1 |
| Ubuntu 18.04 LTS | underscore | 1.8.3~dfsg-1ubuntu0.1 |
| Ubuntu 20.04 LTS | underscore | 1.9.1~dfsg-1ubuntu0.20.04.1 |
| Ubuntu Pro 14.04 LTS | underscore | 1.4.4-2ubuntu1+esm1 |
| openSUSE Leap 15.2 | nodejs-underscore | 1.13.1-lp152.4.3.1 |
| openSUSE Tumbleweed | nodejs-underscore | 1.13.1-1.3 |