Homepage

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') The advisory has been revoked - it doesn't affect any version of package libradospp-devel  (opens in a new tab)

Threat Intelligence

EPSS
1.29% (86th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL8-LIBRADOSPPDEVEL-7413428
  • published29 Jun 2024
  • disclosed5 Jul 2023
Report a new vulnerability Found a mistake?

Introduced: 5 Jul 2023

CVE-2023-36665  (opens in a new tab)
CWE-1321  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libradospp-devel package and not the libradospp-devel package as distributed by RHEL.

"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.