{
  "threat_severity" : "Moderate",
  "public_date" : "2024-04-10T00:00:00Z",
  "bugzilla" : {
    "description" : "mysql2: Prototype Poisoning",
    "id" : "2274489",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2274489"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
    "status" : "draft"
  },
  "cwe" : "CWE-1321",
  "details" : [ "Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.", "A prototype pollution vulnerability was found in mysql2. Insecure results in object creation and improper user input sanitization can lead to prototype poisoning." ],
  "package_state" : [ {
    "product_name" : "Red Hat Developer Hub",
    "fix_state" : "Not affected",
    "package_name" : "rhdh-hub-container",
    "cpe" : "cpe:/a:redhat:rhdh:1"
  }, {
    "product_name" : "Red Hat Developer Hub",
    "fix_state" : "Not affected",
    "package_name" : "rhdh-operator-container",
    "cpe" : "cpe:/a:redhat:rhdh:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-21509\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-21509\nhttps://github.com/sidorares/node-mysql2/commit/4a964a3910a4b8de008696c554ab1b492e9b4691\nhttps://github.com/sidorares/node-mysql2/pull/2574\nhttps://github.com/sidorares/node-mysql2/releases/tag/v3.9.4" ],
  "name" : "CVE-2024-21509",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}