CVE-2020-8116

Description

A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or proto paths. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement

In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable dot-prop library to authenticated users only, therefore the impact is Low.

Red Hat Openshift Container Storage 4 is not affected by this vulnerability, as it already includes patched version of dot-prop(v5.2.0) in noobaa-core container.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score7.37.3N/A
Attack VectorNetworkNetworkN/A
Attack ComplexityLowLowN/A
Privileges RequiredNoneNoneN/A
User InteractionNoneNoneN/A
ScopeUnchangedUnchangedN/A
ConfidentialityLowLowN/A
Integrity ImpactLowLowN/A
Availability ImpactLowLowN/A

Vector

Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Understanding the Weakness (CWE)

CWE-471

Integrity

Technical Impact: Modify Application Data

Common data types that are attacked are environment variables, web application parameters, and HTTP headers.

Integrity

Technical Impact: Unexpected State

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.