Fedora has issued an advisory on February 8: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV/ The issue is fixed upstream in 3.0.1. Mageia 7 is also affected.
Whiteboard: (none) => MGA7TOO
Status comment: (none) => Fixed upstream in 3.0.1
Advisory: This update upgrade nodejs-set-value to version 3.0.2 to fix CVE-2019-10747. References: https://lists.apache.org/thread.html/b46f35559c4a97cf74d2dd7fe5a48f8abf2ff37f879083920af9b292@%3Cdev.drat.apache.org%3E https://snyk.io/vuln/SNYK-JS-SETVALUE-450213 rpms: nodejs-set-value-3.0.2-1.mga7 from: nodejs-set-value-3.0.2-1.mga7
Status comment: Fixed upstream in 3.0.1 => (none)Version: Cauldron => 7CC: (none) => mageiaAssignee: smelror => qa-bugsWhiteboard: MGA7TOO => (none)
Advisory: ======================== Updated nodejs-set-value package fixes security vulnerability: A vulnerability was found in NOdejs set-value, where set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads (CVE-2019-10747). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10747 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV/
MGA7-64 Plasma on Lenovo B50 No installation issues. No previous updates. # urpmq --whatrequires-recursive nodejs-set-value nodejs-engine nodejs-set-value This is java , so OK on clean install as usual
CC: (none) => herman.viaeneWhiteboard: (none) => MGA7-64-OK
Validating. Advisory in Comment 2.
CC: (none) => andrewsfarm, sysadmin-bugsKeywords: (none) => validated_update
Keywords: (none) => advisoryStatus comment: (none) => advisory
Status comment: advisory => (none)
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2020-0230.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED