VDB
RHSA-2021%3A3454
RHSA-2021%3A3454
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in nodejs-kind-of. An external user is allowed input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhacm2/memcached-rhel8@sha256:aaa00a47521e0ce184533c232e3c29172c0e85be3c8db321d7b11ba88840f446_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/memcached-rhel8@sha256:aaa00a47521e0ce184533c232e3c29172c0e85be3c8db321d7b11ba88840f446_amd64 |
| Red Hat | rhacm2/grc-ui-api-rhel8@sha256:8db6551f2001a0f1a6e0082fd2451d2d8c60b04e7de5896a9f57fcbce9fd8699_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/grc-ui-api-rhel8@sha256:8db6551f2001a0f1a6e0082fd2451d2d8c60b04e7de5896a9f57fcbce9fd8699_ppc64le |
| Red Hat | rhacm2/governance-policy-status-sync-rhel8@sha256:f185b29054fff8338cb347c15b7f70667b816c1dfb354f8604b60af81e618521_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/governance-policy-status-sync-rhel8@sha256:f185b29054fff8338cb347c15b7f70667b816c1dfb354f8604b60af81e618521_amd64 |
| Red Hat | rhacm2/iam-policy-controller-rhel8@sha256:57395728e66afb6e89e00acefbe4ec79b6ff06be40acde0d96cb023548bbadf6_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | * |
| Red Hat | rhacm2/insights-client-rhel8@sha256:64490ec4883ffcb2442ebf61ea5eb849d6e45058025697bedf54a0d730c21813_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/insights-client-rhel8@sha256:64490ec4883ffcb2442ebf61ea5eb849d6e45058025697bedf54a0d730c21813_amd64 |
| Red Hat | rhacm2/rbac-query-proxy-rhel8@sha256:b903dfc9a5d3696dc8fc2f4aa075f53e5a4edfd20017dc1c2aac23559be896d2_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | * |
| Red Hat | rhacm2/work-rhel8@sha256:901d66a1c77e3f3cb190f25e71171c3130537a1f0580fedf9a6c6af6f81d104e_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/work-rhel8@sha256:901d66a1c77e3f3cb190f25e71171c3130537a1f0580fedf9a6c6af6f81d104e_ppc64le |
| Red Hat | rhacm2/config-policy-controller-rhel8@sha256:3932b351ad496bd8f4216aec6395d8e35562b9f6b659b6979d0bdd055d8e8e12_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/config-policy-controller-rhel8@sha256:3932b351ad496bd8f4216aec6395d8e35562b9f6b659b6979d0bdd055d8e8e12_amd64 |
| Red Hat | rhacm2/prometheus-alertmanager-rhel8@sha256:d81c9ef8a9d7dc59eafb0666477b4d4e09983acbd265b00be6b6ed44cc0a115d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | * |
| Red Hat | rhacm2/multicluster-operators-application-rhel8@sha256:ed6aab2768b0db2005ac1bbe278f075398b0d16300d1ca71d46eabae99cb4d8a_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/multicluster-operators-application-rhel8@sha256:ed6aab2768b0db2005ac1bbe278f075398b0d16300d1ca71d46eabae99cb4d8a_amd64 |
| Red Hat | rhacm2/work-rhel8@sha256:ccf03e6f7aab20e7f84af8998ebc3c82da9de5fdee70734cee8522ca2863f7cf_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/work-rhel8@sha256:ccf03e6f7aab20e7f84af8998ebc3c82da9de5fdee70734cee8522ca2863f7cf_s390x |
| Red Hat | rhacm2/search-ui-rhel8@sha256:2846e0545c8312519a8eb8a837b509ed0726c2611ab30085690a2f3aec489470_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/search-ui-rhel8@sha256:2846e0545c8312519a8eb8a837b509ed0726c2611ab30085690a2f3aec489470_amd64 |
| Red Hat | rhacm2/acm-operator-bundle@sha256:e42aaecece83d407393b6693fcc135f5f2f24159dda56fceb32a025dcb5ae816_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | * |
| Red Hat | rhacm2/metrics-collector-rhel8@sha256:c18ed8b1076ff4778b0b328246b2ceea6bcc3c5f4dee93f56804226d2f9af387_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/metrics-collector-rhel8@sha256:c18ed8b1076ff4778b0b328246b2ceea6bcc3c5f4dee93f56804226d2f9af387_amd64 |
| Red Hat | rhacm2/redisgraph-tls-rhel8@sha256:7f6a81be08ecaf218b716a96f632c1b24b97f0ed4da6c311eb9ac5d392501c28_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/redisgraph-tls-rhel8@sha256:7f6a81be08ecaf218b716a96f632c1b24b97f0ed4da6c311eb9ac5d392501c28_ppc64le |
| Red Hat | rhacm2/placement-rhel8@sha256:0c13de6dc74a8a598dc2f275988db24e4b9ff069f9c1f0ceab82cf18c0833931_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/placement-rhel8@sha256:0c13de6dc74a8a598dc2f275988db24e4b9ff069f9c1f0ceab82cf18c0833931_amd64 |
| Red Hat | rhacm2/kui-web-terminal-rhel8@sha256:26a8906c334f9cee62a216b1e059af7aef27c84d020884be174c0a0464a2c5be_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/kui-web-terminal-rhel8@sha256:26a8906c334f9cee62a216b1e059af7aef27c84d020884be174c0a0464a2c5be_ppc64le |
| Red Hat | rhacm2/klusterlet-addon-rhel8-operator@sha256:c14d30bac80764165b7140de5eb00b72340d27f866bd561ebc36e07cfbf59c42_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/klusterlet-addon-rhel8-operator@sha256:c14d30bac80764165b7140de5eb00b72340d27f866bd561ebc36e07cfbf59c42_s390x |
| Red Hat | rhacm2/governance-policy-template-sync-rhel8@sha256:4e55cd5d1588042c6659d2430f5c033ccc2a828dda7645557b352941ffbd565d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/governance-policy-template-sync-rhel8@sha256:4e55cd5d1588042c6659d2430f5c033ccc2a828dda7645557b352941ffbd565d_ppc64le |
| Red Hat | rhacm2/multicluster-operators-subscription-rhel8@sha256:33a1ef1ee69f88c34870ae3d07720f15d861c25e9a3a22b6681a5daf67042acf_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 | rhacm2/multicluster-operators-subscription-rhel8@sha256:33a1ef1ee69f88c34870ae3d07720f15d861c25e9a3a22b6681a5daf67042acf_amd64 |
…and 121 more
Timeline
- Sep 7, 2021 CVE Published
- Apr 30, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2021:3454 advisory
- https://access.redhat.com/security/updates/classification/#low advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1959721 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1991623 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3454.json advisory
- https://access.redhat.com/security/cve/CVE-2019-20149 advisory
- https://www.cve.org/CVERecord?id=CVE-2019-20149 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-20149 advisory
- https://snyk.io/vuln/SNYK-JS-KINDOF-537849 advisory