CVE-2019-20149
Description
A flaw was found in nodejs-kind-of. An external user is allowed input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Statement
While some components do package a vulnerable version of kind-of, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. This applies to the following products:
- OpenShift ServiceMesh (OSSM)
- Red Hat Advanced Cluster Management for Kubernetes (RHACM)
- OpenShift distributed tracing
- OpenShift Data Foundation
In Openshift Container Platform (OCP) 4.6 the openshift4/ose-logging-kibana container delivers a vulnerable version of kind-of, however OCP 4.6 is Out Of Support Scope (OOSS) for Moderate and Low impact vulnerabilities. Since the release of OCP 4.7 this component is now delivered as part of the OpenShift Logging product (openshift-logging/kibana6-rhel8 container). Further, OCP 3.11 has been set to Will not fix, as OCP 3.11 is moving into maintenance phase of support.
In Red Hat Virtualization some components do package a version of kind-of, however none use an affected version (later than 6.0.0, prior to 6.0.3)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | High | High | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat CVSS v3 Score Explanation
Being able to overwrite internal attributes assumes a program using kind-of is written in such a way that overwriting that names is possible via a network connection, or an adjacent network. Making the attack complexity high instead of low.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
An attacker could provide unexpected values and cause a program crash or arbitrary control of resource allocation, leading to excessive consumption of resources such as memory and CPU.
Confidentiality
Technical Impact: Read Memory; Read Files or Directories
An attacker could read confidential data if they are able to control resource references.
Integrity,Confidentiality,Availability
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
An attacker could use malicious input to modify data or possibly alter control flow in unexpected ways, including arbitrary command execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
