CVE-2021-23450
Fixed in a distro release EPSS 30%CVSS 7.5
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
Products: linuxfoundation dojo, oracle communications_policy_management, oracle primavera_unifier, oracle weblogic_server, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | dojo | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | dojo | 1.14.2+dfsg1-1+deb10u3 |
| Debian 12 | dojo | 1.17.2+dfsg1-1 |
| Debian 13 | dojo | 1.17.2+dfsg1-1 |
| Debian 14 | dojo | 1.17.2+dfsg1-1 |
| Ubuntu 18.04 LTS | dojo | no fix |
| Ubuntu 22.04 LTS | dojo | 1.15.4+dfsg1-1ubuntu0.1 |
| Ubuntu Pro 16.04 LTS | dojo | 1.10.4+dfsg-2ubuntu0.1~esm1 |
| Ubuntu Pro 20.04 LTS | dojo | 1.15.0+dfsg1-1ubuntu0.1~esm1 |