snorlyd/https-nj.gov---cve-2019-11358Vulnearability Report of the New Jersey official site
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.
''' @@ -158,8 +158,9 @@ jQuery.extend = jQuery.fn.extend = function() {'''
'''for ( name in options ) {
copy = options[ name ];
// Prevent Object.prototype pollution
// Prevent never-ending loop
if ( target === copy ) {
if ( name === "__proto__" || target === copy ) {
continue;
} '''
'''@@ -1062,6 +1062,13 @@ QUnit.test( "jQuery.extend(true,{},{a:[], o:{}}); deep copy with array, followed'''
'''assert.ok( !Array.isArray( result.object ), "result.object wasn't paved with an empty array" );
} );
QUnit.test( "jQuery.extend( true, ... ) Object.prototype pollution", function( assert ) {
assert.expect( 1 );
jQuery.extend( true, {}, JSON.parse( "{\"__proto__\": {\"devMode\": true}}" ) );
assert.ok( !( "devMode" in {} ), "Object.prototype not polluted" );
} );
QUnit.test( "jQuery.each(Object,Function)", function( assert ) {
assert.expect( 23 );'''
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html http://seclists.org/fulldisclosure/2019/May/10 http://seclists.org/fulldisclosure/2019/May/11 http://seclists.org/fulldisclosure/2019/May/13 http://www.openwall.com/lists/oss-security/2019/06/03/2 http://www.securityfocus.com/bid/108023 https://access.redhat.com/errata/RHBA-2019:1570 https://access.redhat.com/errata/RHSA-2019:1456 https://access.redhat.com/errata/RHSA-2019:2587 https://access.redhat.com/errata/RHSA-2019:3023 https://access.redhat.com/errata/RHSA-2019:3024 https://backdropcms.org/security/backdrop-sa-core-2019-009 https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b https://github.com/jquery/jquery/pull/4333