-
Notifications
You must be signed in to change notification settings - Fork 636
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
prototype pollution vulnearability due to hoek dependency #225
Comments
That is actually a transitive dependency through |
This is fixed in |
It will be in 1.10.1, actually |
We have now published grpc 1.10.1, which depends on node-pre-gyp 0.7.0. |
This issue still persists : https://nvd.nist.gov/vuln/detail/CVE-2018-3728 for |
You're right. It looks like node-pre-gyp didn't actually remove that dependency until 0.9.0. So this will actually be fixed when we upgrade to that. Doing so is currently blocked on mapbox/node-pre-gyp#356 |
It looks like mapbox/node-pre-gyp#356 / mapbox/node-pre-gyp#371 has been resolved in v0.10.0 of node-pre-gyp: https://github.com/mapbox/node-pre-gyp/commits/master Does that mean we're good to go? |
1.11.1 has been published with the newest version of node-pre-gyp, and we're upmerging this to master, yes. |
Observed following security vulnerability in the grpc node package (even on latest version 1.10.0)
The
merge
function, and theapplyToDefaults
andapplyToDefaultsWithShallow
functions which leveragemerge
behind the scenes, are vulnerable to a prototype pollution attack when provided an unvalidated payload created from a JSON string containing the__proto__
property. This can be demonstrated like so:javascript var Hoek = require('hoek'); var malicious_payload = '{"__proto__":{"oops":"It works !"}}'; var a = {}; console.log("Before : " + a.oops); Hoek.merge({}, JSON.parse(malicious_payload)); console.log("After : " + a.oops);
This type of attack can be used to overwrite existing properties causing a potential denial of service.
This can be fixed by updating the dependency version to
hoek@4.2.1
The text was updated successfully, but these errors were encountered: