CVE-2022-37616

Publication date 11 October 2022

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."

Status

Show unmaintained releases

Package	Ubuntu Release	Status
node-xmldom	23.04 lunar	Not affected
	22.10 kinetic	Fixed 0.7.5-1ubuntu0.22.10.1
	22.04 LTS jammy	Fixed 0.7.5-1ubuntu0.22.04.1
	20.04 LTS focal	Fixed 0.1.27+ds-1+deb10u2build0.20.04.1
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Ignored
	14.04 LTS trusty	Ignored

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
node-xmldom	Upstream: 6956ec4

Severity score breakdown

Parameter	Value
Base score	9.8 · Critical
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

USN-6102-1
xmldom vulnerabilities
24 May 2023