Core: Prevent Object.prototype pollution for $.extend( true, ... )

[mgol]

Summary

Prevent Object.prototype pollution for $.extend( true, ... )

Checklist

• All authors have signed the CLA at https://cla.js.foundation/jquery/jquery
• New tests have been added to show the fix or feature works
• Grunt build and unit tests pass locally with these changes
• If needed, a docs issue/PR was created at https://github.com/jquery/api.jquery.com

[DanielRuf]

added this to the 3.4.0 milestone 4 days ago

Imo security patches should be patch releases then for all affected versions (3.3, 3.x, 2.x).

Do we really need a 3.4.0 release?

[oliviernt]

I second @DanielRuf. A patch would allow a smoother update path without requiring everybody to wait for the (currently 13) unresolved issues to be resolved and then having to test if the minor version doesn't break anything...

[DanielRuf]

Short question:

Was a CVE ID requested for this?

[lirantal]

I will be requesting that through the Node.js Security WG and update once we have it.

[lirantal]

Any ETA regarding the new version?

[mgol]

If all goes well, it should be out within the next few days. -- Michał Gołębiowski-Owczarek

[DanielRuf]

@oliviernt you can maybe use these patches or try to create one with patch-package or native diff -u orig patched.

I have published some for the unmodified releases at https://github.com/DanielRuf/snyk-js-jquery-174006?files=1

I have also created a YARA rule for DevSecOps solutions if needed.

We will probably patch the used versions in all our projects.

[louissanchez84]

@DanielRuf

This might be a stupid question, but is jquery-3.3.1.min impacted as well?

[DanielRuf]

@louissanchez84 all versions are impacted by this vuln.

[DanielRuf]

I have only created the patches for the latest releases of 1.x, 2.x and 3.x. The unminified releases can be patched with the same patch files and fuzzy patching (should be the case by default).

[louissanchez84]

@DanielRuf Thank you for the quick response.

[mgol]

jQuery 3.4.0 with the fix has been released:
https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/

We don’t plan to backport the change ourselves to older release lines at this point. jQuery 3.0 has been released a few years ago already and older versions have a more serious CVE on them that we only fixed in jQuery 3.0 as someone might depend on the older behavior:
https://jquery.com/upgrade-guide/3.0/#breaking-change-cross-domain-script-requests-must-be-declared

[lirantal]

CVE assigned: CVE-2019-5428
Node.js Security WG report: nodejs/security-wg#507

[iamleot]

Side-note regarding the CVE(s)... Isn't CVE-2019-5428 a duplicate of CVE-2019-11358? If that's the case, @lirantal can you please get in touch with MITRE to mark it as duplicate?

Thank you!

[lirantal]

5248 targets the vulnerability in jquery as the product, where-as 11358 targets a Drupal version (or component inside it) as an advisory. Not convinced they are duplicates though.

[iamleot]

Hello Liran, Liran Tal writes:

5248 targets the vulnerability in jquery as the product, where-as 11358 targets a Drupal version (or component inside it) as an advisory. Not convinced they are duplicates though.

Can you please elaborate further why they are not duplicates? (aren't they describing the same problem?) Thanks!

[lirantal]

I take it back. They do seem duplicates as the NVD report actually refers to jQuery and in short glance it seemed to be referring to Drupal. I'll contact them and update.

[DanielRuf]

CVE-2019-5428 does also not link the Snyk report directly. While CVE-2019-11358 does.

I have linked CVE-2019-11358 as it contains more info.

[DanielRuf]

Assigning CNA for https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5428 was HackerOne.

[lirantal]

Request logged at CVE Request 679060

[iamleot]

Liran Tal writes:

Request logged at CVE Request 679060

Thank you Liran!

[iamleot]

Hello Daniel, we probably can't. These are sent as reply via (private) emails to who submit update for CVE entries via the CVE form.

[DanielRuf]

Ah ok. Not sure what this other number is (request? much higher number) but I'll wait and still use the CVE-2019-11358 in references as it contains the scores and the analysis is not pending .

[lirantal]

Update from MITRE ticket: CVE-2019-11358 will be the leading one and others will be mentioned and set as duplicates.

Have a great weekend fellas!