CVE-2020-36604

A prototype pollution flaw was found the clone function of the hapi/hoek package. By adding or modifying properties of Object.prototype using a proto or constructor payload, an attacker could execute arbitrary code or cause a denial of service condition on the system...

@makeomatic/confidence (5.0.0), @makeomatic/deploy (>=10.0.1, <=10.2.1) +6 more potentially affected by CVE-2020-36604 via @hapi/hoek (9.0.2)

@hapi/hoek NPM version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hoek and may be impacted: - @makeomatic/confidence 5.0.0 - @makeomatic/deploy =10.0.1, =6.0.0, =15.0.0, =10.0.0, =8.0.0, =14.0.0, =6.1.2, =6.8.3 Source cves:...

@condiments/chow-chow (>=3.0.0, <=3.0.1), @condiments/relish (>=4.0.0, <=4.0.1) +22 more potentially affected by CVE-2020-36604 via @hapi/hoek (>=8.1.0, <=8.5.0)

@hapi/hoek NPM version =8.1.0, =3.0.0, =4.0.0, =8.4.4, =1.5.2, =3.0.0, =3.0.0, =1.8.2, =1.8.2, =1.1.1, =2.2.0, =3.0.0, =1.8.2, =1.5.0, =1.5.1 and more Source cves: CVE-2020-36604 Source advisory: GHSA-C429-5P7V-VGJP...

@condiments/chow-chow (>=3.0.0, <=3.0.1), @condiments/relish (>=4.0.0, <=4.0.1) +22 more potentially affected by CVE-2020-36604 via @hapi/hoek (>=8.1.0, <=8.5.0)

@hapi/hoek NPM version =8.1.0, =3.0.0, =4.0.0, =8.4.4, =1.5.2, =3.0.0, =3.0.0, =1.8.2, =1.8.2, =1.1.1, =2.2.0, =3.0.0, =1.8.2, =1.5.0, =1.5.1 and more Source cves: CVE-2020-36604 Source advisory: OSV:GHSA-C429-5P7V-VGJP...

@makeomatic/confidence (5.0.0), @makeomatic/deploy (>=10.0.1, <=10.2.1) +6 more potentially affected by CVE-2020-36604 via @hapi/hoek (9.0.2)

@hapi/hoek NPM version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hoek and may be impacted: - @makeomatic/confidence 5.0.0 - @makeomatic/deploy =10.0.1, =6.0.0, =15.0.0, =10.0.0, =8.0.0, =14.0.0, =6.1.2, =6.8.3 Source cves:...

@makeomatic/confidence (5.0.0), @makeomatic/deploy (>=10.0.1, <=10.2.1) +6 more potentially affected by CVE-2020-36604 via @hapi/hoek (9.0.2)

@hapi/hoek NPM version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hoek and may be impacted: - @makeomatic/confidence 5.0.0 - @makeomatic/deploy =10.0.1, =6.0.0, =15.0.0, =10.0.0, =8.0.0, =14.0.0, =6.1.2, =6.8.3 Source cves:...

3nit-utils (0.24.0), @adobe/io-cna-scripts (>=0.1.0, <=0.3.2) +401 more potentially affected by CVE-2020-36604 via @hapi/hoek (>=6.2.4, <=8.5.0)

@hapi/hoek NPM version =6.2.4, =0.1.0, =1.0.0, =1.0.0, =1.0.1, =2.4.0-next.0, =0.1.0, =2.2.0-alpha.6, =0.2.0, =0.1.0, =0.2.0, =3.0.0-alpha.0, =0.2.0, =0.1.0, =2.2.0-alpha.8 and more Source cves: CVE-2020-36604 Source advisory: MEND:CVE-2020-36604...

@pixul/nodemailer-sparkpost (>=3.0.0, <=3.0.3), @pixul/sparkpost (>=3.0.0, <=3.0.1) +7 more potentially affected by unknown CVE via @hapi/hoek (>=8.3.2, <=8.5.0)

@hapi/hoek NPM version =8.3.2, =3.0.0, =3.0.0, =1.8.2, =1.8.2, =1.1.1, =2.2.0, =1.8.2, =1.5.0, =2.0.0, =2.0.1 Source cves: unknown CVE Source advisory: GHSA-22H7-7WWG-QMGG...

@makeomatic/confidence (5.0.0), @makeomatic/deploy (>=10.0.1, <=10.2.1) +6 more potentially affected by unknown CVE via @hapi/hoek (9.0.2)

@hapi/hoek NPM version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hoek and may be impacted: - @makeomatic/confidence 5.0.0 - @makeomatic/deploy =10.0.1, =6.0.0, =15.0.0, =10.0.0, =8.0.0, =14.0.0, =6.1.2, =6.8.3 Source cves: unknown CVE...

Prototype Pollution in @hapi/hoek

Versions of @hapi/hoek prior to 8.5.1 and 9.0.3 are vulnerable to Prototype Pollution. The clone function fails to prevent the modification of the Object prototype when passed specially-crafted input. Attackers may use this to change existing properties that exist in all objects, which may lead t...

GHSA-22H7-7WWG-QMGG Prototype Pollution in @hapi/hoek

Versions of @hapi/hoek prior to 8.5.1 and 9.0.3 are vulnerable to Prototype Pollution. The clone function fails to prevent the modification of the Object prototype when passed specially-crafted input. Attackers may use this to change existing properties that exist in all objects, which may lead t...

@pixul/nodemailer-sparkpost (>=3.0.0, <=3.0.3), @pixul/sparkpost (>=3.0.0, <=3.0.1) +7 more potentially affected by unknown CVE via @hapi/hoek (>=8.3.2, <=8.5.0)

@hapi/hoek NPM version =8.3.2, =3.0.0, =3.0.0, =1.8.2, =1.8.2, =1.1.1, =2.2.0, =1.8.2, =1.5.0, =2.0.0, =2.0.1 Source cves: unknown CVE Source advisory: OSV:GHSA-22H7-7WWG-QMGG...

PT-2020-20944

Name of the Vulnerable Software and Affected Versions @hapi/hoek versions prior to 8.5.1 @hapi/hoek versions prior to 9.0.3 Description The issue concerns Prototype Pollution due to the clone function in @hapi/hoek failing to prevent the modification of the Object prototype when passed...

Prototype Pollution

@hapi/hoek is vulnerable to prototype pollution. Failure to validate object to prevent modification of object prototype in clone function allows an attacker to inject malicious object properties which can potentially lead to execution of arbitrary code. The vulnerability affects only applications...

Prototype Pollution

Overview Versions of @hapi/hoek prior to 8.5.1 and 9.0.3 are vulnerable to Prototype Pollution. The clone function fails to prevent the modification of the Object prototype when passed specially-crafted input. Attackers may use this to change existing properties that exist in all objects, which m...