| Name | CVE-2024-38999 |
| Description | jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1077543 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| requirejs (PTS) | bullseye | 2.3.6+ds-1 | vulnerable |
| bookworm | 2.3.6+ds+~2.1.34-2 | vulnerable |
| trixie, sid | 2.3.7+ds+~2.1.37-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| requirejs | source | (unstable) | 2.3.7+ds+~2.1.37-1 | | | 1077543 |
Notes
[bookworm] - requirejs <no-dsa> (Minor issue)
[bullseye] - requirejs <no-dsa> (Minor issue)
https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a
https://github.com/requirejs/requirejs/issues/1854
https://github.com/requirejs/requirejs/pull/1856
https://github.com/requirejs/requirejs/commit/6e8a234303deaf80ef619e66a2f5c6616bb7e6d9 (2.3.7)