PT-2022-28202
تاريخ النشر
2022-01-08
·
تاريخ التحديث
2022-01-08
الوصف من
الدرجة
N/A
غير متوفرلا تتوفر حاليًا تقييمات أو مقاييس للخطورة. سنحدّث المعلومات المقابلة في الصفحة فور توفرها.
Name of the Vulnerable Software and Affected Versions
node-forge versions prior to 1.0.0
Description
The issue concerns a potential prototype pollution problem in the
forge.debug API when used with untrusted input. This API was used internally for debug purposes and was not documented or advertised, suggesting its usage with untrusted inputs would be rare.Recommendations
For versions prior to 1.0.0, consider removing or avoiding the use of the
forge.debug API with untrusted input as a temporary workaround. The definitive fix is to update to version 1.0.0 or later, where the forge.debug API and related functions have been removed. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾