CVE-2020-7788

NameCVE-2020-7788
DescriptionThis affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2503-1
Debian Bugs977718

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
node-ini (PTS)buster1.3.5-1+deb10u1fixed
bullseye2.0.0-1fixed
sid, trixie, bookworm3.0.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
node-inisourcestretch1.1.0-1+deb9u1DLA-2503-1
node-inisourcebuster1.3.5-1+deb10u1
node-inisource(unstable)2.0.0-1977718

Notes

https://snyk.io/vuln/SNYK-JS-INI-1048974
https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1 (v1.3.6)

Search for package or bug name: Reporting problems