Debian Security Advisory

DLA-3291-1 node-object-path -- LTS security update

Date Reported:
29 Jan 2023
Affected Packages:
node-object-path
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2021-3805, CVE-2021-23434.
More information:

It was discovered that node-object-path, a Node.js module to access deep object properties using dot-separated paths, was vulnerable to prototype pollution.

  • CVE-2021-3805

    Prototype pollution vulnerability in the del(), empty(), push() and insert() functions when using the inherited props mode (e.g. when a new object-path instance is created with the includeInheritedProps option set to true or when using the withInheritedProps default instance).

  • CVE-2021-23434

    A type confusion vulnerability can lead to a bypass of the CVE-2020-15256 fix when the path components used in the path parameter are arrays, because the === operator returns always false when the type of the operands is different.

For Debian 10 buster, these problems have been fixed in version 0.11.4-2+deb10u2.

We recommend that you upgrade your node-object-path packages.

For the detailed security status of node-object-path please refer to its security tracker page at: https://security-tracker.debian.org/tracker/node-object-path

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS