CVE-2024-38998

NameCVE-2024-38998
Descriptionjrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1077543

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
requirejs (PTS)bullseye2.3.6+ds-1vulnerable
bookworm2.3.6+ds+~2.1.34-2vulnerable
sid, trixie2.3.7+ds+~2.1.37-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
requirejssource(unstable)2.3.7+ds+~2.1.37-11077543

Notes

[bookworm] - requirejs <no-dsa> (Minor issue)
[bullseye] - requirejs <no-dsa> (Minor issue)
https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a
https://github.com/requirejs/requirejs/issues/1854
https://github.com/requirejs/requirejs/pull/1856
https://github.com/requirejs/requirejs/commit/6e8a234303deaf80ef619e66a2f5c6616bb7e6d9 (2.3.7)

Search for package or bug name: Reporting problems