Bug 1227255 - VUL-0: CVE-2024-38998: nodejs-electron: requirejs: prototype pollution via function config
Summary: VUL-0: CVE-2024-38998: nodejs-electron: requirejs: prototype pollution via fu...
Status: NEW
Alias: None
Product: openSUSE Distribution
Classification: openSUSE
Component: Security (show other bugs)
Version: Leap 15.6
Hardware: Other Other
: P3 - Medium : Major (vote)
Target Milestone: ---
Assignee: Bruno Pitrus
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/412486/
Whiteboard:
Keywords:
Depends on:
Blocks: CVE-2024-38998
  Show dependency tree / graph
 
Reported: 2024-07-01 19:47 UTC by Camila Camargo de Matos
Modified: 2024-07-02 10:25 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---
brunopitrus: needinfo? (camila.matos)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Camila Camargo de Matos 2024-07-01 19:47:36 UTC 
+++ This bug was initially created as a clone of Bug #1227247 +++

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-38998
https://www.cve.org/CVERecord?id=CVE-2024-38998
https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a
https://bugzilla.redhat.com/show_bug.cgi?id=2294942
Comment 2 Bruno Pitrus 2024-07-01 19:53:52 UTC 
I grepped the tar file list for `requirejs` and could not find anything relevant, and you also did not provide a patch that i could match to any existing files.