阿里云漏洞库

中危 async_project async improperly controlled modification of object prototype attributes ('prototype pollution')

CVE编号

CVE-2021-43138

利用情况

暂无

补丁情况

官方补丁

披露时间

2022-04-07

漏洞描述

A vulnerability exists in Async through 3.2.1 (fixed in 3.2.2) , which could let a malicious user obtain privileges via the mapValues() method.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/caolan/async/blob/master/lib/internal/iterator.js
https://github.com/caolan/async/blob/master/lib/mapValuesLimit.js
https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264
https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d
https://github.com/caolan/async/compare/v2.6.3...v2.6.4
https://github.com/caolan/async/pull/1828
https://jsfiddle.net/oz5twjd9/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...

受影响软件情况

1
#	类型	厂商	产品	版本	影响面
	运行在以下环境
	应用	async_project	async	*		Up to (excluding) 3.2.2
	运行在以下环境
	系统	debian_10	node-async	*		Up to (excluding) 0.8.0-3
	运行在以下环境
	系统	debian_11	node-async	*		Up to (excluding) 0.8.0-4
	运行在以下环境
	系统	debian_12	node-async	*		Up to (excluding) 0.8.0-6
	运行在以下环境
	系统	fedora_36	yarnpkg	*		Up to (excluding) 1.22.19-3.fc36
	运行在以下环境
	系统	fedora_37	yarnpkg	*		Up to (excluding) 1.22.19-3.fc37
	运行在以下环境
	系统	fedora_38	python-engineio	*		Up to (excluding) 4.3.4-2.fc38
	运行在以下环境
	系统	fedora_EPEL_9	yarnpkg	*		Up to (excluding) 1.22.19-5.el9
	运行在以下环境
	系统	opensuse_Leap_15.4	wire	*		Up to (excluding) 9.16.6-150000.12.65.1
	运行在以下环境
	系统	opensuse_Leap_15.5	wire	*		Up to (excluding) 0.5.0-150000.1.12.3

攻击路径

本地
攻击复杂度

复杂
权限要求

无需权限
影响范围

越权影响
EXP成熟度

未验证
补丁情况

官方补丁
数据保密性

数据泄露
数据完整性

无影响
服务器危害

无影响
全网数量

N/A

CWE-ID	漏洞类型
CWE-1321	Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')