CVE-2020-7788

NameCVE-2020-7788
DescriptionThis affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2503-1
NVD severityhigh
Debian Bugs977718

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
node-ini (PTS)stretch1.1.0-1vulnerable
stretch (security)1.1.0-1+deb9u1fixed
buster1.3.5-1+deb10u1fixed
bullseye, sid2.0.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
node-inisourcestretch1.1.0-1+deb9u1DLA-2503-1
node-inisourcebuster1.3.5-1+deb10u1
node-inisource(unstable)2.0.0-1977718

Notes

https://snyk.io/vuln/SNYK-JS-INI-1048974
https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1 (v1.3.6)

Search for package or bug name: Reporting problems