Fix CVE–2020–7677

[debricked-staging]

CVE–2020–7677

Vulnerability details

Description

GitHub

thenify before 3.3.1 made use of unsafe calls to eval.

Versions of thenify prior to 3.3.1 made use of unsafe calls to eval. Untrusted user input could thus lead to arbitrary code execution on the host. The patch in version 3.3.1 removes calls to eval.

NVD

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

GitLab Advisory Database (Open Source Edition)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

References

    npm/thenify/CVE-2020-7677.yml · main · GitLab.org / GitLab Advisory Database Open Source Edition · GitLab
    NVD - CVE-2020-7677
    thenify before 3.3.1 made use of unsafe calls to eval. · CVE-2020-7677 · GitHub Advisory Database · GitHub
    Arbitrary Code Execution Affecting thenify package, ALL versions · Issue #29 · thenables/thenify · GitHub
    fix: remove eval (#30) · thenables/thenify@0d94a24 · GitHub
    Arbitrary Code Execution in thenify | CVE-2020-7677 | Snyk
    Arbitrary Code Execution in org.webjars.npm:thenify | CVE-2020-7677 | Snyk
    THIRD PARTY
    thenify/index.js at master · thenables/thenify · GitHub
    [SECURITY] [DLA 3128-1] node-thenify security update
    [SECURITY] Fedora 36 Update: yarnpkg-1.22.19-3.fc36 - package-announce - Fedora Mailing-Lists
    [SECURITY] Fedora 37 Update: yarnpkg-1.22.19-3.fc37 - package-announce - Fedora Mailing-Lists

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE