[rush] CVE-2021-42581 (Critical) detected in ramda-0.25.0.tgz
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- node.js, typescript
- Domain
- build-system, security, tooling
Research direction
Start with the npm install -g @microsoft/rush reproduction and trace which dependency declaration supplies ramda-0.27.2.tgz. Check the declared and resolved Ramda versions against CVE-2021-42581; done means the dependency is upgraded to a version accepted by the registry and global installation succeeds.
Written by the indexing model from the issue text.
Description
$ npm install -g @microsoft/rush
The previous command failed because our private npm registry blocked the download of ramda-0.27.2.tgz due to security policies triggered by CVE-2021-42581. Are there plans to upgrade the Ramda dependency to a version that resolves this vulnerability and ensures successful installation?
Vulnerability Details
Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "proto") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes
Publish Date: 2022-05-10
URL: CVE-2021-42581
- Dominant language
- TypeScript
- Stars
- 6.5k
- Forks
- 708
- Avg merge
- 4d 13h
- Merged PRs (30d)
- 62
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/rushstack
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
All issues in microsoft/rushstack
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
security
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
IBM/node-sdk-core#373 ·
-
e2e-failure ready-to-code
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
chore
Difficulty 2/5 1-3 hours Newbie friendliness 88/100