Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-10768 (GCVE-0-2019-10768)
Vulnerability from cvelistv5 – Published: 2019-11-19 20:07 – Updated: 2024-08-04 22:32
VLAI
EPSS
Summary
In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
Severity
7.5 (High)
CWE
- Prototype Pollution
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://snyk.io/vuln/SNYK-JS-ANGULAR-534884 | x_refsource_MISC |
| https://lists.apache.org/thread.html/rca37935d661… | mailing-listx_refsource_MLIST |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:32:01.679Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://snyk.io/vuln/SNYK-JS-ANGULAR-534884"
},
{
"name": "[nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "AngularJS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "All versions prior to version 1.7.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Prototype Pollution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-24T04:06:05.000Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://snyk.io/vuln/SNYK-JS-ANGULAR-534884"
},
{
"name": "[nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "report@snyk.io",
"ID": "CVE-2019-10768",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "AngularJS",
"version": {
"version_data": [
{
"version_value": "All versions prior to version 1.7.9"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Prototype Pollution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://snyk.io/vuln/SNYK-JS-ANGULAR-534884",
"refsource": "MISC",
"url": "https://snyk.io/vuln/SNYK-JS-ANGULAR-534884"
},
{
"name": "[nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2019-10768",
"datePublished": "2019-11-19T20:07:49.000Z",
"dateReserved": "2019-04-03T00:00:00.000Z",
"dateUpdated": "2024-08-04T22:32:01.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2019-10768",
"date": "2026-06-07",
"epss": "0.00411",
"percentile": "0.61797"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:angularjs:angular.js:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.7.9\", \"matchCriteriaId\": \"7AF3494B-4D74-4765-8747-A5160D2AC21B\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.\"}, {\"lang\": \"es\", \"value\": \"En AngularJS versiones anteriores a 1.7.9, la funci\\u00f3n \\\"merge()\\\" podr\\u00eda ser enga\\u00f1ada para agregar o modificar propiedades de \\\"Object.prototype\\\" usando una carga \\u00fatil de \\\" __proto__\\\".\"}]",
"id": "CVE-2019-10768",
"lastModified": "2024-11-21T04:19:53.053",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:N/I:P/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2019-11-19T21:15:11.703",
"references": "[{\"url\": \"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E\", \"source\": \"report@snyk.io\"}, {\"url\": \"https://snyk.io/vuln/SNYK-JS-ANGULAR-534884\", \"source\": \"report@snyk.io\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://snyk.io/vuln/SNYK-JS-ANGULAR-534884\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}]",
"sourceIdentifier": "report@snyk.io",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-1321\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2019-10768\",\"sourceIdentifier\":\"report@snyk.io\",\"published\":\"2019-11-19T21:15:11.703\",\"lastModified\":\"2025-11-20T18:00:14.787\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.\"},{\"lang\":\"es\",\"value\":\"En AngularJS versiones anteriores a 1.7.9, la funci\u00f3n \\\"merge()\\\" podr\u00eda ser enga\u00f1ada para agregar o modificar propiedades de \\\"Object.prototype\\\" usando una carga \u00fatil de \\\" __proto__\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:P/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1321\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:angularjs:angularjs:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.7.9\",\"matchCriteriaId\":\"67C6E97B-DAA5-4CC9-A9FD-6EA74DAA0383\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E\",\"source\":\"report@snyk.io\"},{\"url\":\"https://snyk.io/vuln/SNYK-JS-ANGULAR-534884\",\"source\":\"report@snyk.io\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://snyk.io/vuln/SNYK-JS-ANGULAR-534884\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]}]}}"
}
}
RHSA-2021_0417
Vulnerability from csaf_redhat - Published: 2021-02-04 13:36 - Updated: 2024-11-24 21:25Summary
Red Hat Security Advisory: Red Hat AMQ Broker 7.8.1 release and security update
Severity
Moderate
Notes
Topic: Red Hat AMQ Broker 7.8.1 is now available from the Red Hat Customer Portal.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms.
This release of Red Hat AMQ Broker 7.8.1 serves as a replacement for Red Hat AMQ Broker 7.8.0, and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
* jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)
* guava: local information disclosure via temporary directory created with unsafe permissions (CVE-2020-8908)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ 7.8.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A XSS flaw was found in nodejs-angular. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "\<option\>" elements in "\<select\>" ones changes parsing behavior, leading to possibly unsanitizing code.
5.4 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ 7.8.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure.
CWE-200 - Exposure of Sensitive Information to an Unauthorized ActorAffected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ 7.8.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7
|
— |
Vendor Fix
fix
|
Threats
Impact
Low
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.
4.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ 7.8.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in AMQ 7 broker, where it allows users using the OpenWire protocol to bypass the usual permissions checks. This flaw allows an unprivileged user to create queues without verifying the role. The highest threat from this vulnerability is to integrity.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat AMQ 7.8.1
Red Hat / Red Hat JBoss AMQ
|
cpe:/a:redhat:amq_broker:7
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
30 references
Acknowledgments
Red Hat
Francesco Marchioni
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat AMQ Broker 7.8.1 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms. \n\nThis release of Red Hat AMQ Broker 7.8.1 serves as a replacement for Red Hat AMQ Broker 7.8.0, and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)\n\n* guava: local information disclosure via temporary directory created with unsafe permissions (CVE-2020-8908)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:0417",
"url": "https://access.redhat.com/errata/RHSA-2021:0417"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.broker\u0026version=7.8.1",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.broker\u0026version=7.8.1"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_amq/7.8/",
"url": "https://access.redhat.com/documentation/en-us/red_hat_amq/7.8/"
},
{
"category": "external",
"summary": "1902826",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1902826"
},
{
"category": "external",
"summary": "1906919",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1906919"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0417.json"
}
],
"title": "Red Hat Security Advisory: Red Hat AMQ Broker 7.8.1 release and security update",
"tracking": {
"current_release_date": "2024-11-24T21:25:25+00:00",
"generator": {
"date": "2024-11-24T21:25:25+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2021:0417",
"initial_release_date": "2021-02-04T13:36:09+00:00",
"revision_history": [
{
"date": "2021-02-04T13:36:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-02-04T13:36:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-24T21:25:25+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat AMQ 7.8.1",
"product": {
"name": "Red Hat AMQ 7.8.1",
"product_id": "Red Hat AMQ 7.8.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:amq_broker:7"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss AMQ"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-10768",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2019-11-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1813309"
}
],
"notes": [
{
"category": "description",
"text": "A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "AngularJS: Prototype pollution in merge function could result in code injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Whilst servicemesh-grafana, and grafana-container both include a vulnerable version of angular.js (v1.6.6) the impact is lowered due to Grafana not directly implementing the angular.merge function.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ 7.8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-10768"
},
{
"category": "external",
"summary": "RHBZ#1813309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-10768",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10768"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768"
},
{
"category": "external",
"summary": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3",
"url": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3"
}
],
"release_date": "2019-11-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-04T13:36:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ 7.8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0417"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ 7.8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "AngularJS: Prototype pollution in merge function could result in code injection"
},
{
"cve": "CVE-2020-7676",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2020-06-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1849206"
}
],
"notes": [
{
"category": "description",
"text": "A XSS flaw was found in nodejs-angular. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping \"\\\u003coption\\\u003e\" elements in \"\\\u003cselect\\\u003e\" ones changes parsing behavior, leading to possibly unsanitizing code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-angular: XSS due to regex-based HTML replacement",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ 7.8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-7676"
},
{
"category": "external",
"summary": "RHBZ#1849206",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849206"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-7676",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7676"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7676",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7676"
},
{
"category": "external",
"summary": "https://snyk.io/vuln/SNYK-JS-ANGULAR-570058",
"url": "https://snyk.io/vuln/SNYK-JS-ANGULAR-570058"
}
],
"release_date": "2020-05-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-04T13:36:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ 7.8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0417"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ 7.8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nodejs-angular: XSS due to regex-based HTML replacement"
},
{
"cve": "CVE-2020-8908",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-12-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1906919"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "guava: local information disclosure via temporary directory created with unsafe permissions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform\u0027s OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Important and Critical flaws.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ 7.8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-8908"
},
{
"category": "external",
"summary": "RHBZ#1906919",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1906919"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-8908",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8908"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8908",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8908"
}
],
"release_date": "2020-09-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-04T13:36:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ 7.8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0417"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ 7.8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "guava: local information disclosure via temporary directory created with unsafe permissions"
},
{
"cve": "CVE-2020-27218",
"cwe": {
"id": "CWE-226",
"name": "Sensitive Information in Resource Not Removed Before Reuse"
},
"discovery_date": "2020-11-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1902826"
}
],
"notes": [
{
"category": "description",
"text": "In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jetty: buffer not correctly recycled in Gzip Request inflation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of jetty.\nSince the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix.\nThis may be fixed in the future.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ 7.8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-27218"
},
{
"category": "external",
"summary": "RHBZ#1902826",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1902826"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-27218",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-27218"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-27218",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27218"
},
{
"category": "external",
"summary": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-86wm-rrjm-8wh8",
"url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-86wm-rrjm-8wh8"
}
],
"release_date": "2020-11-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-04T13:36:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ 7.8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0417"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat AMQ 7.8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jetty: buffer not correctly recycled in Gzip Request inflation"
},
{
"acknowledgments": [
{
"names": [
"Francesco Marchioni"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2021-26118",
"cwe": {
"id": "CWE-285",
"name": "Improper Authorization"
},
"discovery_date": "2020-10-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1892384"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in AMQ 7 broker, where it allows users using the OpenWire protocol to bypass the usual permissions checks. This flaw allows an unprivileged user to create queues without verifying the role. The highest threat from this vulnerability is to integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "7: OpenWire can create destinations with an unpriviledged user",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AMQ 7.8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-26118"
},
{
"category": "external",
"summary": "RHBZ#1892384",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1892384"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-26118",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26118"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-26118",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26118"
}
],
"release_date": "2020-10-28T12:25:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-02-04T13:36:09+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat AMQ 7.8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:0417"
},
{
"category": "workaround",
"details": "If you are not using the openwire protocol, it can be disabled by removing it from the list of accepted protocols in the `broker.xml`\n```xml\n\u003cacceptor name=\"artemis\"\u003etcp://0.0.0.0:61616?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;amqpMinLargeMessageSize=102400;protocols=CORE,AMQP,STOMP,HORNETQ,MQTT;useEpoll=true;amqpCredits=1000;amqpLowCredits=300;amqpDuplicateDetection=true\u003c/acceptor\u003e\n```",
"product_ids": [
"Red Hat AMQ 7.8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AMQ 7.8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "7: OpenWire can create destinations with an unpriviledged user"
}
]
}
RHSA-2022:8849
Vulnerability from csaf_redhat - Published: 2022-12-07 19:19 - Updated: 2026-05-14 22:32Summary
Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (python-XStatic-Angular) security update
Severity
Moderate
Notes
Topic: An update for python-XStatic-Angular is now available for Red Hat OpenStack
Platform 16.2.4 (Train).
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details: Angular JavaScript library packaged for setuptools (easy_install) / pip.
Security Fix(es):
* Prototype pollution in merge function could result in code injection
(CVE-2019-10768)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-RHOS-16.2:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOS-16.2:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOS-16.2:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-XStatic-Angular is now available for Red Hat OpenStack\nPlatform 16.2.4 (Train).\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Angular JavaScript library packaged for setuptools (easy_install) / pip.\n\nSecurity Fix(es):\n\n* Prototype pollution in merge function could result in code injection\n(CVE-2019-10768)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2022:8849",
"url": "https://access.redhat.com/errata/RHSA-2022:8849"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1813309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813309"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8849.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (python-XStatic-Angular) security update",
"tracking": {
"current_release_date": "2026-05-14T22:32:51+00:00",
"generator": {
"date": "2026-05-14T22:32:51+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2022:8849",
"initial_release_date": "2022-12-07T19:19:26+00:00",
"revision_history": [
{
"date": "2022-12-07T19:19:26+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2022-12-07T19:19:26+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:32:51+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 16.2",
"product": {
"name": "Red Hat OpenStack Platform 16.2",
"product_id": "8Base-RHOS-16.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:16.2::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"product": {
"name": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"product_id": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/XStatic-Angular-common@1.5.8.0-13.el8ost?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"product": {
"name": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"product_id": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-XStatic-Angular@1.5.8.0-13.el8ost?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"product": {
"name": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"product_id": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-XStatic-Angular@1.5.8.0-13.el8ost?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch as a component of Red Hat OpenStack Platform 16.2",
"product_id": "8Base-RHOS-16.2:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch"
},
"product_reference": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"relates_to_product_reference": "8Base-RHOS-16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src as a component of Red Hat OpenStack Platform 16.2",
"product_id": "8Base-RHOS-16.2:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src"
},
"product_reference": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"relates_to_product_reference": "8Base-RHOS-16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch as a component of Red Hat OpenStack Platform 16.2",
"product_id": "8Base-RHOS-16.2:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
},
"product_reference": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"relates_to_product_reference": "8Base-RHOS-16.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-10768",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2019-11-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1813309"
}
],
"notes": [
{
"category": "description",
"text": "A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "AngularJS: Prototype pollution in merge function could result in code injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Whilst servicemesh-grafana, and grafana-container both include a vulnerable version of angular.js (v1.6.6) the impact is lowered due to Grafana not directly implementing the angular.merge function.\n\nQuay does not contain the affected vulnerable code pattern.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOS-16.2:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"8Base-RHOS-16.2:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"8Base-RHOS-16.2:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-10768"
},
{
"category": "external",
"summary": "RHBZ#1813309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-10768",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10768"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768"
},
{
"category": "external",
"summary": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3",
"url": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3"
}
],
"release_date": "2019-11-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-12-07T19:19:26+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHOS-16.2:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"8Base-RHOS-16.2:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"8Base-RHOS-16.2:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8849"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-RHOS-16.2:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"8Base-RHOS-16.2:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"8Base-RHOS-16.2:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "AngularJS: Prototype pollution in merge function could result in code injection"
}
]
}
RHSA-2022:8866
Vulnerability from csaf_redhat - Published: 2022-12-07 20:28 - Updated: 2026-05-14 22:32Summary
Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (python-XStatic-Angular) security update
Severity
Moderate
Notes
Topic: An update for python-XStatic-Angular is now available for Red Hat OpenStack
Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details: Angular JavaScript library packaged for setuptools (easy_install) / pip.
Security Fix(es):
* Prototype pollution in merge function could result in code injection
(CVE-2019-10768)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-RHOS-16.1:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOS-16.1:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOS-16.1:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-XStatic-Angular is now available for Red Hat OpenStack\nPlatform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Angular JavaScript library packaged for setuptools (easy_install) / pip.\n\nSecurity Fix(es):\n\n* Prototype pollution in merge function could result in code injection\n(CVE-2019-10768)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2022:8866",
"url": "https://access.redhat.com/errata/RHSA-2022:8866"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1813309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813309"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8866.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (python-XStatic-Angular) security update",
"tracking": {
"current_release_date": "2026-05-14T22:32:57+00:00",
"generator": {
"date": "2026-05-14T22:32:57+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2022:8866",
"initial_release_date": "2022-12-07T20:28:07+00:00",
"revision_history": [
{
"date": "2022-12-07T20:28:07+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2022-12-07T20:28:07+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:32:57+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 16.1",
"product": {
"name": "Red Hat OpenStack Platform 16.1",
"product_id": "8Base-RHOS-16.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:16.1::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"product": {
"name": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"product_id": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/XStatic-Angular-common@1.5.8.0-13.el8ost?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"product": {
"name": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"product_id": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-XStatic-Angular@1.5.8.0-13.el8ost?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"product": {
"name": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"product_id": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-XStatic-Angular@1.5.8.0-13.el8ost?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1",
"product_id": "8Base-RHOS-16.1:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch"
},
"product_reference": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"relates_to_product_reference": "8Base-RHOS-16.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src as a component of Red Hat OpenStack Platform 16.1",
"product_id": "8Base-RHOS-16.1:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src"
},
"product_reference": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"relates_to_product_reference": "8Base-RHOS-16.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1",
"product_id": "8Base-RHOS-16.1:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
},
"product_reference": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"relates_to_product_reference": "8Base-RHOS-16.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-10768",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2019-11-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1813309"
}
],
"notes": [
{
"category": "description",
"text": "A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "AngularJS: Prototype pollution in merge function could result in code injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Whilst servicemesh-grafana, and grafana-container both include a vulnerable version of angular.js (v1.6.6) the impact is lowered due to Grafana not directly implementing the angular.merge function.\n\nQuay does not contain the affected vulnerable code pattern.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOS-16.1:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"8Base-RHOS-16.1:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"8Base-RHOS-16.1:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-10768"
},
{
"category": "external",
"summary": "RHBZ#1813309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-10768",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10768"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768"
},
{
"category": "external",
"summary": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3",
"url": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3"
}
],
"release_date": "2019-11-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-12-07T20:28:07+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHOS-16.1:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"8Base-RHOS-16.1:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"8Base-RHOS-16.1:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8866"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-RHOS-16.1:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"8Base-RHOS-16.1:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"8Base-RHOS-16.1:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "AngularJS: Prototype pollution in merge function could result in code injection"
}
]
}
RHSA-2022_8849
Vulnerability from csaf_redhat - Published: 2022-12-07 19:19 - Updated: 2024-11-13 22:26Summary
Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (python-XStatic-Angular) security update
Severity
Moderate
Notes
Topic: An update for python-XStatic-Angular is now available for Red Hat OpenStack
Platform 16.2.4 (Train).
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details: Angular JavaScript library packaged for setuptools (easy_install) / pip.
Security Fix(es):
* Prototype pollution in merge function could result in code injection
(CVE-2019-10768)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-RHOS-16.2:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOS-16.2:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOS-16.2:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-XStatic-Angular is now available for Red Hat OpenStack\nPlatform 16.2.4 (Train).\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Angular JavaScript library packaged for setuptools (easy_install) / pip.\n\nSecurity Fix(es):\n\n* Prototype pollution in merge function could result in code injection\n(CVE-2019-10768)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2022:8849",
"url": "https://access.redhat.com/errata/RHSA-2022:8849"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1813309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813309"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8849.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (python-XStatic-Angular) security update",
"tracking": {
"current_release_date": "2024-11-13T22:26:55+00:00",
"generator": {
"date": "2024-11-13T22:26:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2022:8849",
"initial_release_date": "2022-12-07T19:19:26+00:00",
"revision_history": [
{
"date": "2022-12-07T19:19:26+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2022-12-07T19:19:26+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-13T22:26:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 16.2",
"product": {
"name": "Red Hat OpenStack Platform 16.2",
"product_id": "8Base-RHOS-16.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:16.2::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"product": {
"name": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"product_id": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/XStatic-Angular-common@1.5.8.0-13.el8ost?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"product": {
"name": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"product_id": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-XStatic-Angular@1.5.8.0-13.el8ost?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"product": {
"name": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"product_id": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-XStatic-Angular@1.5.8.0-13.el8ost?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch as a component of Red Hat OpenStack Platform 16.2",
"product_id": "8Base-RHOS-16.2:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch"
},
"product_reference": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"relates_to_product_reference": "8Base-RHOS-16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src as a component of Red Hat OpenStack Platform 16.2",
"product_id": "8Base-RHOS-16.2:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src"
},
"product_reference": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"relates_to_product_reference": "8Base-RHOS-16.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch as a component of Red Hat OpenStack Platform 16.2",
"product_id": "8Base-RHOS-16.2:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
},
"product_reference": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"relates_to_product_reference": "8Base-RHOS-16.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-10768",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2019-11-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1813309"
}
],
"notes": [
{
"category": "description",
"text": "A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "AngularJS: Prototype pollution in merge function could result in code injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Whilst servicemesh-grafana, and grafana-container both include a vulnerable version of angular.js (v1.6.6) the impact is lowered due to Grafana not directly implementing the angular.merge function.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOS-16.2:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"8Base-RHOS-16.2:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"8Base-RHOS-16.2:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-10768"
},
{
"category": "external",
"summary": "RHBZ#1813309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-10768",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10768"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768"
},
{
"category": "external",
"summary": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3",
"url": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3"
}
],
"release_date": "2019-11-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-12-07T19:19:26+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHOS-16.2:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"8Base-RHOS-16.2:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"8Base-RHOS-16.2:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8849"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-RHOS-16.2:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"8Base-RHOS-16.2:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"8Base-RHOS-16.2:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "AngularJS: Prototype pollution in merge function could result in code injection"
}
]
}
RHSA-2022_8866
Vulnerability from csaf_redhat - Published: 2022-12-07 20:28 - Updated: 2024-11-13 22:27Summary
Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (python-XStatic-Angular) security update
Severity
Moderate
Notes
Topic: An update for python-XStatic-Angular is now available for Red Hat OpenStack
Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details: Angular JavaScript library packaged for setuptools (easy_install) / pip.
Security Fix(es):
* Prototype pollution in merge function could result in code injection
(CVE-2019-10768)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-RHOS-16.1:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOS-16.1:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOS-16.1:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-XStatic-Angular is now available for Red Hat OpenStack\nPlatform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Angular JavaScript library packaged for setuptools (easy_install) / pip.\n\nSecurity Fix(es):\n\n* Prototype pollution in merge function could result in code injection\n(CVE-2019-10768)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2022:8866",
"url": "https://access.redhat.com/errata/RHSA-2022:8866"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1813309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813309"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8866.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (python-XStatic-Angular) security update",
"tracking": {
"current_release_date": "2024-11-13T22:27:19+00:00",
"generator": {
"date": "2024-11-13T22:27:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2022:8866",
"initial_release_date": "2022-12-07T20:28:07+00:00",
"revision_history": [
{
"date": "2022-12-07T20:28:07+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2022-12-07T20:28:07+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-13T22:27:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 16.1",
"product": {
"name": "Red Hat OpenStack Platform 16.1",
"product_id": "8Base-RHOS-16.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:16.1::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"product": {
"name": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"product_id": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/XStatic-Angular-common@1.5.8.0-13.el8ost?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"product": {
"name": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"product_id": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-XStatic-Angular@1.5.8.0-13.el8ost?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"product": {
"name": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"product_id": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-XStatic-Angular@1.5.8.0-13.el8ost?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1",
"product_id": "8Base-RHOS-16.1:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch"
},
"product_reference": "XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"relates_to_product_reference": "8Base-RHOS-16.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src as a component of Red Hat OpenStack Platform 16.1",
"product_id": "8Base-RHOS-16.1:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src"
},
"product_reference": "python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"relates_to_product_reference": "8Base-RHOS-16.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1",
"product_id": "8Base-RHOS-16.1:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
},
"product_reference": "python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch",
"relates_to_product_reference": "8Base-RHOS-16.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-10768",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2019-11-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1813309"
}
],
"notes": [
{
"category": "description",
"text": "A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "AngularJS: Prototype pollution in merge function could result in code injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Whilst servicemesh-grafana, and grafana-container both include a vulnerable version of angular.js (v1.6.6) the impact is lowered due to Grafana not directly implementing the angular.merge function.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOS-16.1:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"8Base-RHOS-16.1:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"8Base-RHOS-16.1:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-10768"
},
{
"category": "external",
"summary": "RHBZ#1813309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-10768",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10768"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768"
},
{
"category": "external",
"summary": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3",
"url": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3"
}
],
"release_date": "2019-11-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-12-07T20:28:07+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-RHOS-16.1:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"8Base-RHOS-16.1:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"8Base-RHOS-16.1:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8866"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-RHOS-16.1:XStatic-Angular-common-1:1.5.8.0-13.el8ost.noarch",
"8Base-RHOS-16.1:python-XStatic-Angular-1:1.5.8.0-13.el8ost.src",
"8Base-RHOS-16.1:python3-XStatic-Angular-1:1.5.8.0-13.el8ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "AngularJS: Prototype pollution in merge function could result in code injection"
}
]
}
RHSA-2023:0274
Vulnerability from csaf_redhat - Published: 2023-01-25 12:30 - Updated: 2026-05-14 22:32Summary
Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (python-XStatic-Angular) security update
Severity
Moderate
Notes
Topic: An update for python-XStatic-Angular is now available for Red Hat OpenStack
Platform 17.0 (Wallaby).
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details: Angular JavaScript library packaged for setuptools (easy_install) / pip.
Security Fix(es):
* Prototype pollution in merge function could result in code injection
(CVE-2019-10768)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOS-17.0:XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOS-17.0:python-XStatic-Angular-1:1.5.8.0-15.el9ost.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOS-17.0:python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-XStatic-Angular is now available for Red Hat OpenStack\nPlatform 17.0 (Wallaby).\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Angular JavaScript library packaged for setuptools (easy_install) / pip.\n\nSecurity Fix(es):\n\n* Prototype pollution in merge function could result in code injection\n(CVE-2019-10768)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2023:0274",
"url": "https://access.redhat.com/errata/RHSA-2023:0274"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1813309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813309"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0274.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (python-XStatic-Angular) security update",
"tracking": {
"current_release_date": "2026-05-14T22:32:55+00:00",
"generator": {
"date": "2026-05-14T22:32:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.0"
}
},
"id": "RHSA-2023:0274",
"initial_release_date": "2023-01-25T12:30:59+00:00",
"revision_history": [
{
"date": "2023-01-25T12:30:59+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2023-01-25T12:30:59+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-14T22:32:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 17.0",
"product": {
"name": "Red Hat OpenStack Platform 17.0",
"product_id": "9Base-RHOS-17.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:17.0::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"product": {
"name": "XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"product_id": "XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/XStatic-Angular-common@1.5.8.0-15.el9ost?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch",
"product": {
"name": "python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch",
"product_id": "python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-XStatic-Angular@1.5.8.0-15.el9ost?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"product": {
"name": "python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"product_id": "python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-XStatic-Angular@1.5.8.0-15.el9ost?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch as a component of Red Hat OpenStack Platform 17.0",
"product_id": "9Base-RHOS-17.0:XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch"
},
"product_reference": "XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"relates_to_product_reference": "9Base-RHOS-17.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-XStatic-Angular-1:1.5.8.0-15.el9ost.src as a component of Red Hat OpenStack Platform 17.0",
"product_id": "9Base-RHOS-17.0:python-XStatic-Angular-1:1.5.8.0-15.el9ost.src"
},
"product_reference": "python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"relates_to_product_reference": "9Base-RHOS-17.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch as a component of Red Hat OpenStack Platform 17.0",
"product_id": "9Base-RHOS-17.0:python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch"
},
"product_reference": "python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch",
"relates_to_product_reference": "9Base-RHOS-17.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-10768",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2019-11-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1813309"
}
],
"notes": [
{
"category": "description",
"text": "A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "AngularJS: Prototype pollution in merge function could result in code injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Whilst servicemesh-grafana, and grafana-container both include a vulnerable version of angular.js (v1.6.6) the impact is lowered due to Grafana not directly implementing the angular.merge function.\n\nQuay does not contain the affected vulnerable code pattern.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOS-17.0:XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"9Base-RHOS-17.0:python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"9Base-RHOS-17.0:python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-10768"
},
{
"category": "external",
"summary": "RHBZ#1813309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-10768",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10768"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768"
},
{
"category": "external",
"summary": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3",
"url": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3"
}
],
"release_date": "2019-11-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-01-25T12:30:59+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-RHOS-17.0:XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"9Base-RHOS-17.0:python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"9Base-RHOS-17.0:python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:0274"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOS-17.0:XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"9Base-RHOS-17.0:python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"9Base-RHOS-17.0:python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "AngularJS: Prototype pollution in merge function could result in code injection"
}
]
}
RHSA-2023_0274
Vulnerability from csaf_redhat - Published: 2023-01-25 12:30 - Updated: 2024-11-13 22:27Summary
Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (python-XStatic-Angular) security update
Severity
Moderate
Notes
Topic: An update for python-XStatic-Angular is now available for Red Hat OpenStack
Platform 17.0 (Wallaby).
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details: Angular JavaScript library packaged for setuptools (easy_install) / pip.
Security Fix(es):
* Prototype pollution in merge function could result in code injection
(CVE-2019-10768)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOS-17.0:XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOS-17.0:python-XStatic-Angular-1:1.5.8.0-15.el9ost.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOS-17.0:python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-XStatic-Angular is now available for Red Hat OpenStack\nPlatform 17.0 (Wallaby).\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Angular JavaScript library packaged for setuptools (easy_install) / pip.\n\nSecurity Fix(es):\n\n* Prototype pollution in merge function could result in code injection\n(CVE-2019-10768)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2023:0274",
"url": "https://access.redhat.com/errata/RHSA-2023:0274"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1813309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813309"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0274.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (python-XStatic-Angular) security update",
"tracking": {
"current_release_date": "2024-11-13T22:27:34+00:00",
"generator": {
"date": "2024-11-13T22:27:34+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2023:0274",
"initial_release_date": "2023-01-25T12:30:59+00:00",
"revision_history": [
{
"date": "2023-01-25T12:30:59+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2023-01-25T12:30:59+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-13T22:27:34+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Platform 17.0",
"product": {
"name": "Red Hat OpenStack Platform 17.0",
"product_id": "9Base-RHOS-17.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:17.0::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"product": {
"name": "XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"product_id": "XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/XStatic-Angular-common@1.5.8.0-15.el9ost?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch",
"product": {
"name": "python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch",
"product_id": "python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-XStatic-Angular@1.5.8.0-15.el9ost?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"product": {
"name": "python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"product_id": "python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-XStatic-Angular@1.5.8.0-15.el9ost?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch as a component of Red Hat OpenStack Platform 17.0",
"product_id": "9Base-RHOS-17.0:XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch"
},
"product_reference": "XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"relates_to_product_reference": "9Base-RHOS-17.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-XStatic-Angular-1:1.5.8.0-15.el9ost.src as a component of Red Hat OpenStack Platform 17.0",
"product_id": "9Base-RHOS-17.0:python-XStatic-Angular-1:1.5.8.0-15.el9ost.src"
},
"product_reference": "python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"relates_to_product_reference": "9Base-RHOS-17.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch as a component of Red Hat OpenStack Platform 17.0",
"product_id": "9Base-RHOS-17.0:python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch"
},
"product_reference": "python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch",
"relates_to_product_reference": "9Base-RHOS-17.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-10768",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2019-11-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1813309"
}
],
"notes": [
{
"category": "description",
"text": "A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "AngularJS: Prototype pollution in merge function could result in code injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Whilst servicemesh-grafana, and grafana-container both include a vulnerable version of angular.js (v1.6.6) the impact is lowered due to Grafana not directly implementing the angular.merge function.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOS-17.0:XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"9Base-RHOS-17.0:python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"9Base-RHOS-17.0:python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-10768"
},
{
"category": "external",
"summary": "RHBZ#1813309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-10768",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10768"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10768"
},
{
"category": "external",
"summary": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3",
"url": "https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3"
}
],
"release_date": "2019-11-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-01-25T12:30:59+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-RHOS-17.0:XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"9Base-RHOS-17.0:python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"9Base-RHOS-17.0:python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2023:0274"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOS-17.0:XStatic-Angular-common-1:1.5.8.0-15.el9ost.noarch",
"9Base-RHOS-17.0:python-XStatic-Angular-1:1.5.8.0-15.el9ost.src",
"9Base-RHOS-17.0:python3-XStatic-Angular-1:1.5.8.0-15.el9ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "AngularJS: Prototype pollution in merge function could result in code injection"
}
]
}
WID-SEC-W-2023-0206
Vulnerability from csaf_certbund - Published: 2023-01-25 23:00 - Updated: 2024-09-23 22:00Summary
Red Hat OpenStack (AngularJS): Schwachstelle ermöglicht Manipulation von Dateien
Severity
Mittel
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Red Hat OpenStack ist eine Sammlung von Diensten, um Cloud-Computing in Form von Infrastructure as a Service (IaaS) bereitstellen zu können.
Angriff: Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenStack ausnutzen, um Dateien zu manipulieren.
Betroffene Betriebssysteme: - Linux
- UNIX
Es existiert eine Schwachstelle in Red Hat OpenStack. Der Fehler besteht aufgrund einer Verunreinigung des Prototyps in AngularJS. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, indem er böswillige Eingaben in die merge()-Funktion einspeist, um Code zu injizieren und so Daten zu manipulieren.
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat OpenStack <17.0
Red Hat / OpenStack
|
<17.0 | ||
|
IBM Spectrum Protect Plus <10.1.16.3
IBM / Spectrum Protect Plus
|
<10.1.16.3 |
References
4 references
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Red Hat OpenStack ist eine Sammlung von Diensten, um Cloud-Computing in Form von Infrastructure as a Service (IaaS) bereitstellen zu k\u00f6nnen.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenStack ausnutzen, um Dateien zu manipulieren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-0206 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0206.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-0206 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0206"
},
{
"category": "external",
"summary": "RHSA-2023:0274 - Security Advisory vom 2023-01-25",
"url": "https://access.redhat.com/errata/RHSA-2023:0274"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7169778 vom 2024-09-24",
"url": "https://www.ibm.com/support/pages/node/7169778"
}
],
"source_lang": "en-US",
"title": "Red Hat OpenStack (AngularJS): Schwachstelle erm\u00f6glicht Manipulation von Dateien",
"tracking": {
"current_release_date": "2024-09-23T22:00:00.000+00:00",
"generator": {
"date": "2024-09-24T08:15:25.697+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.8"
}
},
"id": "WID-SEC-W-2023-0206",
"initial_release_date": "2023-01-25T23:00:00.000+00:00",
"revision_history": [
{
"date": "2023-01-25T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2024-09-23T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von IBM aufgenommen"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c10.1.16.3",
"product": {
"name": "IBM Spectrum Protect Plus \u003c10.1.16.3",
"product_id": "T037795"
}
},
{
"category": "product_version",
"name": "10.1.16.3",
"product": {
"name": "IBM Spectrum Protect Plus 10.1.16.3",
"product_id": "T037795-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:spectrum_protect_plus:10.1.16.3"
}
}
}
],
"category": "product_name",
"name": "Spectrum Protect Plus"
}
],
"category": "vendor",
"name": "IBM"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c17.0",
"product": {
"name": "Red Hat OpenStack \u003c17.0",
"product_id": "T025149"
}
},
{
"category": "product_version",
"name": "17",
"product": {
"name": "Red Hat OpenStack 17.0",
"product_id": "T025149-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:17.0"
}
}
}
],
"category": "product_name",
"name": "OpenStack"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-10768",
"notes": [
{
"category": "description",
"text": "Es existiert eine Schwachstelle in Red Hat OpenStack. Der Fehler besteht aufgrund einer Verunreinigung des Prototyps in AngularJS. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, indem er b\u00f6swillige Eingaben in die merge()-Funktion einspeist, um Code zu injizieren und so Daten zu manipulieren."
}
],
"product_status": {
"known_affected": [
"T025149",
"T037795"
]
},
"release_date": "2023-01-25T23:00:00.000+00:00",
"title": "CVE-2019-10768"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…