CoreCVE
Back

HIGH

nodejs-kind-of: ctorName in index.js allows external user input to overwrite certain internal attributes

Published Dec 30, 2019

Description

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Affected products

Remediation

Red Hat statement

While some components do package a vulnerable version of `kind-of`, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. This applies to the following products: - OpenShift ServiceMesh (OSSM) - Red Hat Advanced Cluster Management for Kubernetes (RHACM) - OpenShift distributed tracing - OpenShift Data Foundation In Openshift Container Platform (OCP) 4.6 the openshift4/ose-logging-kibana container delivers a vulnerable version of `kind-of`, however OCP 4.6 is Out Of Support Scope (OOSS) for Moderate and Low impact vulnerabilities. Since the release of OCP 4.7 this component is now delivered as part of the OpenShift Logging product (openshift-logging/kibana6-rhel8 container). Further, OCP 3.11 has been set to Will not fix, as OCP 3.11 is moving into maintenance phase of support. In Red Hat Virtualization some components do package a version of `kind-of`, however none use an affected version (later than 6.0.0, prior to 6.0.3)

Metrics

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-668

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Dec 30, 2019
Updated Aug 5, 2024
Reserved Dec 30, 2019
Link CVE-2019-20149
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-20149
Red Hat
Severity Moderate
Public date Dec 16, 2019
Links CVE-2019-20149 - Bugzilla
GHSA-6C8F-QPHG-QJGP