USN-5967-1: object-path vulnerabilities

Releases

• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• node-object-path - Access deep object properties using a path

Details

It was discovered that the set() method in object-path could be corrupted
as a result of prototype pollution by sending a message to the parent
process. An attacker could use this issue to cause object-path to crash.
(CVE-2020-15256, CVE-2021-23434, CVE-2021-3805)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• node-object-path - 0.11.4-2ubuntu0.1

Ubuntu 18.04

• node-object-path - 0.11.3-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2021-3805
• CVE-2020-15256
• CVE-2021-23434