[GHSA-9c47-m6qq-7p4h] Prototype Pollution in JSON5 via Parse Method

[jordanbtucker]

Updates

• Affected products
• Description
• References

Comments
Includes information about a backport for v1 and fixes a typo in the Mitigation section.

[github]

Hi there @jdgregson and @jordanbtucker! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our highly-trained Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[ashkulz]

Since @jordanbtucker already updated the project-specific advisory, shouldn't there be some sort of auto-sync in place (i.e. obviating the need for this PR)?

[jordanbtucker]

@ashkulz Updates to the global advisory database need to be vetted by security professionals to ensure its quality and accuracy.

[pkuczynski]

@jordanbtucker out of the interest, how long it usually takes?

[ashkulz]

I guess people are yet to come back from the holidays 🤷‍♂️

[gustaff-weldon]

Looking forward to getting this merged to remove false positives on 1.0.2 version we upgraded to.

[jordanbtucker]

I would look at previous PRs in this repo to get an idea of an ETA and current backlog.

[viceice]

For me those fixes for 2.2.2 and 1.0.2 are pretty much the same 🤔

• v2: json5/json5@7774c10
• v1: json5/json5@62a6540

[advisory-database]

Hi @jordanbtucker! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[tapasmitamishra25]

@jordanbtucker In our apps, we use json5@1.0.2, we still could see the vulnerability and its showing that it will be fixed in 2.2.2. so can you please help here by letting us know how long will it take to reflect in our apps or we need to change something from our end.
Thanks!

[eugene1g]

@tapasmitamishra25 We also have json5@1.0.2 and our vulnerability scanner (trivy) stopped flagging that version. On some CI machine we had to update the scanner database for it to pick up the latest updates for this advisory, but I suspect this PR resolved the issue at the root.