[Git][security-tracker-team/security-tracker][master] Add CVE-2018-16492/node-extend

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
00cec651 by Salvatore Bonaccorso at 2019-02-05T06:11:05Z
Add CVE-2018-16492/node-extend

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -26612,7 +26612,11 @@ CVE-2018-16494
 CVE-2018-16493 (A path traversal vulnerability was found in module ...)
 	TODO: check
 CVE-2018-16492 (A prototype pollution vulnerability was found in module extend <2.0.2, ...)
-	TODO: check
+	- node-extend 3.0.2-1 (unimportant)
+	NOTE: https://snyk.io/vuln/npm:extend:20180424
+	NOTE: https://github.com/justmoon/node-extend/commit/0e68e71d93507fcc391e398bc84abd0666b28190
+	NOTE: https://github.com/justmoon/node-extend/pull/48
+	NOTE: nodejs not covered by security support
 CVE-2018-16491 (A prototype pollution vulnerability was found in node.extend <1.1.7, ...)
 	TODO: check
 CVE-2018-16490 (A prototype pollution vulnerability was found in module mpath <0.5.1 ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/00cec651e045c1df55d2754f26b09fc958dc314f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/00cec651e045c1df55d2754f26b09fc958dc314f
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190205/b23cb4fb/attachment.html>