[RUBYSEC:JQUERY-RAILS-2019-11358] Prototype pollution attack through jQuery $.extend

Severity Medium

Affected Packages 1

Fixed Packages 1

CVEs 1

jQuery before 3.4.0 mishandles jQuery.extend(true, {}, ...) because of
bject.prototype pollution. If an unsanitized source object contained an
enumerable proto property, it could extend the native Object.prototype.

Package	Affected Version
pkg:gem/jquery-rails	< 4.3.4

Package	Fixed Version
pkg:gem/jquery-rails	>= 4.3.4

ID

RUBYSEC:JQUERY-RAILS-2019-11358

Severity

medium

URL

https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/

Published

2019-04-19T00:00:00
(5 years ago)

Modified

2023-06-03T14:31:20
(15 months ago)

Rights

RubySec Security Team

Other Advisories

Source	# ID	URL
Security Advisory	GHSA-6c3j-c64m-qhgq	https://github.com/advisories/GHSA-6c3j-c64m-qhgq
		https://hackerone.com/reports/454365
		https://github.com/jquery/jquery/pull/4333
		https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
		https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#434

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Fixed	pkg:gem/jquery-rails		jquery-rails	>= 4.3.4
Affected	pkg:gem/jquery-rails		jquery-rails	< 4.3.4

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date