3.7 LOW
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
joi: Prototype pollution via a `__proto__` language key in custom messages
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.
References
-
https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr x_refsource_CONFIRM
-
https://github.com/hapijs/joi/pull/3138 x_refsource_MISC
-
https://github.com/hapijs/joi/pull/3139 x_refsource_MISC
Affected products
- ==>= 16.0.0, <= 17.1.1
- ==>= 18.0.0, < 18.2.5
- ==>= 17.2.0, < 17.13.6
Matching in nixpkgs
pkgs.joincap
Merge multiple pcap files together, gracefully
pkgs.python313Packages.pyadjoint-ad
High-level automatic differentiation library
pkgs.python314Packages.pyadjoint-ad
High-level automatic differentiation library
pkgs.akkuPackages.robin-disjoint-set
A disjoint-set data structure
pkgs.haskellPackages.disjoint-sets-st
Imperative ST/IO based disjoint set data structure
pkgs.python313Packages.python-join-api
Python API for interacting with Join by joaoapps
pkgs.python314Packages.python-join-api
Python API for interacting with Join by joaoapps
pkgs.haskellPackages.disjoint-containers
Disjoint containers
pkgs.chickenPackages_5.chickenEggs.disjoint-set
Disjoint set implementation based on Scheme vectors and their indexes
pkgs.chickenPackages_6.chickenEggs.disjoint-set
Disjoint set implementation based on Scheme vectors and their indexes
-
nixos-unstable -
- nixos-unstable-small 0.1.0
Package maintainers
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@qbisi qbisicwate <qbisicwate@gmail.com>
-
@JamieMagee Jamie Magee <jamie.magee@gmail.com>