GHSA-6c3j-c64m-qhgq
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
At a glance
- Published
- Updated
- CVE
- CVE-2019-11358
- Aliases
- DRUPAL-CORE-2019-006, PYSEC-2026-628, SNYK-JS-JQUERY-174006
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles `jQuery.extend(true, {}, ...)` because of `Object.prototype` pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype`.
Affected packages
| Package | Versions |
|---|---|
| npm · jquery | introduced 1.1.4, fixed 3.4.0 |
| RubyGems · jquery-rails | introduced 0, fixed 4.3.4 |
| NuGet · jQuery | introduced 1.1.4, fixed 3.4.0 |
| PyPI · django | introduced 2.0a1, fixed 2.1.9 |
| PyPI · django | introduced 2.2a1, fixed 2.2.2 |
| Maven · org.webjars.npm:jquery | introduced 1.1.4, fixed 3.4.0 |
| Packagist · maximebf/debugbar | introduced 0, fixed 1.19.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-11358 ADVISORY
- https://github.com/maximebf/php-debugbar/issues/447 WEB
- https://github.com/jquery/jquery/pull/4333 WEB
- https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fc WEB
- https://github.com/django/django/commit/34ec52269ade54af31a021b12969913129571a3f WEB
- https://github.com/django/django/commit/95649bc08547a878cebfa1d019edec8cb1b80829 WEB
- https://github.com/django/django/commit/baaf187a4e354bf3976c51e2c83a0d2f8ee6e6ad WEB
- https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5 WEB
- https://seclists.org/bugtraq/2019/Apr/32 WEB
- https://seclists.org/bugtraq/2019/Jun/12 WEB
- https://seclists.org/bugtraq/2019/May/18 WEB
- https://www.tenable.com/security/tns-2020-02 WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA WEB
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html WEB
- https://lists.debian.org/debian-lts-announce/2020/02/msg00024.html WEB
- https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html WEB
- https://lists.debian.org/debian-lts-announce/2019/05/msg00006.html WEB
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E WEB
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E WEB
- https://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d@%3Cissues.flink.apache.org%3E WEB
- https://www.tenable.com/security/tns-2019-08 WEB
- https://www.synology.com/security/advisory/Synology_SA_19_19 WEB
- https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery WEB
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html WEB
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html WEB
- https://www.oracle.com/security-alerts/cpuoct2021.html WEB
- https://www.oracle.com/security-alerts/cpuoct2020.html WEB
- https://www.oracle.com/security-alerts/cpujul2020.html WEB
- https://www.oracle.com/security-alerts/cpujan2022.html WEB
- https://www.oracle.com/security-alerts/cpujan2021.html WEB
- https://www.oracle.com/security-alerts/cpujan2020.html WEB
- https://www.oracle.com/security-alerts/cpuapr2020.html WEB
- https://www.oracle.com/security-alerts/cpuApr2021.html WEB
- https://www.oracle.com//security-alerts/cpujul2021.html WEB
- https://www.drupal.org/sa-core-2019-006 WEB
- https://www.djangoproject.com/weblog/2019/jun/03/security-releases WEB
- https://www.debian.org/security/2019/dsa-4460 WEB
- https://www.debian.org/security/2019/dsa-4434 WEB
- https://web.archive.org/web/20190824065237/http://www.securityfocus.com/bid/108023 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |