CVE-2021-21304
Prototype Pollution in Dynamoose
描述
### Impact In Dynamoose versions 2.0.0-2.6.0 there was a prototype pollution vulnerability in the internal utility method [`lib/utils/object/set.ts`](https://github.com/dynamoose/dynamoose/blob/master/lib/utils/object/set.ts). This method is used throughout the codebase for various operations throughout Dynamoose. We have not seen any evidence of this vulnerability being exploited. We do not believe this issue impacts v1.x.x since this method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions. ### Patches v2.7.0 includes a patch for this vulnerability. ### Workarounds We are unaware of any workarounds to patch this vulnerability other than upgrading to v2.7.0 or greater. ### References - Patch commit hash: 324c62b4709204955931a187362f8999805b1d8e ### For more information If you have any questions or comments about this advisory: * [Contact me](https://charlie.fish/contact) * [Read our Security Policy](https://github.com/dynamoose/dynamoose/blob/master/SECURITY.md) ### Credit - GitHub CodeQL Code Scanning
如何修補 CVE-2021-21304
要修補 CVE-2021-21304,請將受影響套件升級到下列已修補版本。
- —升級至 2.7.0 或更新版本
CVE-2021-21304 正在被利用嗎?
低 — EPSS 為 0.6%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- >= 2.0.0, < 2.7.0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |