hapi/hoek: Prototype Pollution in @hapi/hoek
Published Sep 23, 2022
8.1
HIGHCVSS 3.1
EPSS 1.24%
Description
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
Affected products
No data.
No data.
Migration Toolkit for Containers
rhmtc/openshift-migration-ui-rhel8
Will not fix
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-ui-rhel8
Fix deferred
OpenShift Developer Tools and Services
odo
Will not fix
OpenShift Service Mesh 2
openshift-service-mesh/kiali-rhel8
Will not fix
OpenShift Service Mesh 2.0
openshift-service-mesh/kiali-rhel8
Will not fix
OpenShift Service Mesh 2.0
servicemesh-prometheus
Affected
OpenShift Service Mesh 2.1
openshift-service-mesh/kiali-rhel8
Will not fix
OpenShift Service Mesh 2.1
servicemesh-prometheus
Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/application-ui-rhel8
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/console-rhel8
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/search-ui-rhel8
Not affected
Red Hat Data Grid 8
hapi-hoek
Not affected
Red Hat Decision Manager 7
hapi-hoek
Out of support scope
Red Hat Enterprise Linux 8
pcs
Not affected
Red Hat OpenShift Dev Spaces
devspaces/dashboard-rhel8
Affected
Red Hat Process Automation 7
hapi-hoek
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Migration Toolkit for Containers | rhmtc/openshift-migration-ui-rhel8 | Will not fix | n/a |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-ui-rhel8 | Fix deferred | n/a |
| OpenShift Developer Tools and Services | odo | Will not fix | n/a |
| OpenShift Service Mesh 2 | openshift-service-mesh/kiali-rhel8 | Will not fix | n/a |
| OpenShift Service Mesh 2.0 | openshift-service-mesh/kiali-rhel8 | Will not fix | n/a |
| OpenShift Service Mesh 2.0 | servicemesh-prometheus | Affected | n/a |
| OpenShift Service Mesh 2.1 | openshift-service-mesh/kiali-rhel8 | Will not fix | n/a |
| OpenShift Service Mesh 2.1 | servicemesh-prometheus | Will not fix | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/application-ui-rhel8 | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/console-rhel8 | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/search-ui-rhel8 | Not affected | n/a |
| Red Hat Data Grid 8 | hapi-hoek | Not affected | n/a |
| Red Hat Decision Manager 7 | hapi-hoek | Out of support scope | n/a |
| Red Hat Enterprise Linux 8 | pcs | Not affected | n/a |
| Red Hat OpenShift Dev Spaces | devspaces/dashboard-rhel8 | Affected | n/a |
| Red Hat Process Automation 7 | hapi-hoek | Will not fix | n/a |
@hapi/hoek
npm
Introduced 0 Fixed 8.5.1@hapi/hoek
npm
Introduced 9.0.0 Fixed 9.0.3hoek
npm
Introduced 0 Fixed not fixed
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @hapi/hoek | 0 | 8.5.1 |
| npm | @hapi/hoek | 9.0.0 | 9.0.3 |
| npm | hoek | 0 | not fixed |
Remediation
No remediation recorded yet.
References (9)
- https://access.redhat.com/security/cve/CVE-2020-36604 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2129802 Issue Tracking
- https://github.com/advisories/GHSA-c429-5p7v-vgjp Advisory
- https://github.com/hapijs/hoek/commit/4d0804bc6135ad72afdc5e1ec002b935b2f5216a
- https://github.com/hapijs/hoek/commit/948baf98634a5c206875b67d11368f133034fa90
- https://github.com/hapijs/hoek/issues/352 x_refsource_MISCThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-36604
- https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452%29 x_refsource_MISC
- https://www.cve.org/CVERecord?id=CVE-2020-36604
Change history (0)
No recorded changes yet.