VDB
RHSA-2022%3A0856
RHSA-2022%3A0856
PUBLISHED
CVSS 8.600000381469727 HIGH
Prototype pollution has been discovered in object-path NodeJS library. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.
Risk Scores
CVSS 3.1
8.600000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhacm2/search-rhel8@sha256:e11efdc4c855ad7eada0b3548da7755158649afbdd7b385662d7e4b325bcb6ed_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/search-rhel8@sha256:e11efdc4c855ad7eada0b3548da7755158649afbdd7b385662d7e4b325bcb6ed_amd64 |
| Red Hat | rhacm2/multicluster-operators-placementrule-rhel8@sha256:76b29ba884cf019c84e9723403825dcc27e1b5c51cc3abd4acfc0d3d7164ebdb_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/multicluster-operators-placementrule-rhel8@sha256:76b29ba884cf019c84e9723403825dcc27e1b5c51cc3abd4acfc0d3d7164ebdb_amd64 |
| Red Hat | rhacm2/kui-web-terminal-rhel8@sha256:610151833fcf0d9cd0b8c3b20c0587c3308d3c412e0378c5fab747f8da53eb81_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | * |
| Red Hat | rhacm2/registration-rhel8-operator@sha256:dbd9b0b28e3726375fc43f83f980372173203e92fff68595ac8451e8c6e9344a_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/registration-rhel8-operator@sha256:dbd9b0b28e3726375fc43f83f980372173203e92fff68595ac8451e8c6e9344a_amd64 |
| Red Hat | rhacm2/management-ingress-rhel7@sha256:9fa5c356fecafab9e390c3a733a385962fa720112db6823f7138e37c7b2d0f82_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 | * |
| Red Hat | rhacm2/search-collector-rhel8@sha256:bad30064f99468d1ebd84df8ef1f45d506fff0946e0ccc1878d5613dd33633c0_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/search-collector-rhel8@sha256:bad30064f99468d1ebd84df8ef1f45d506fff0946e0ccc1878d5613dd33633c0_amd64 |
| Red Hat | rhacm2/multicluster-operators-subscription-rhel8@sha256:1265c60311841c662507cff2fd263f00e32e333d43ce51628fda64b6605e19bd_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/multicluster-operators-subscription-rhel8@sha256:1265c60311841c662507cff2fd263f00e32e333d43ce51628fda64b6605e19bd_amd64 |
| Red Hat | rhacm2/governance-policy-spec-sync-rhel8@sha256:344cd37658490b612e6a9d9c8b95d7fda1729a3516c3cdd1665fcc738726cf17_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/governance-policy-spec-sync-rhel8@sha256:344cd37658490b612e6a9d9c8b95d7fda1729a3516c3cdd1665fcc738726cf17_amd64 |
| Red Hat | rhacm2/multicluster-operators-subscription-rhel8@sha256:2f86124dec5e95552f900e0359e15ab0786b9a144922c54bf04a96a049c3abd2_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/multicluster-operators-subscription-rhel8@sha256:2f86124dec5e95552f900e0359e15ab0786b9a144922c54bf04a96a049c3abd2_s390x |
| Red Hat | rhacm2/cainjector-rhel8@sha256:01b8d7629d32020bb1461985f2ad2786fff99d424c78d8347e0e8c2c962807aa_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | * |
| Red Hat | rhacm2/work-rhel8@sha256:4f937eee54593752ebd1fca06f03456ed6be2e71f5e8df3e62256ca8079a631b_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/work-rhel8@sha256:4f937eee54593752ebd1fca06f03456ed6be2e71f5e8df3e62256ca8079a631b_s390x |
| Red Hat | rhacm2/cert-policy-controller-rhel8@sha256:db00be399864cae44fdc3b167f8d33f954bd48be783d1020eee9ededb36482c3_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/cert-policy-controller-rhel8@sha256:db00be399864cae44fdc3b167f8d33f954bd48be783d1020eee9ededb36482c3_amd64 |
| Red Hat | rhacm2/grc-ui-rhel8@sha256:0d21e153282c751271d593ed0eb6f234ba314da85ec42eb54bb8414d36c7043e_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/grc-ui-rhel8@sha256:0d21e153282c751271d593ed0eb6f234ba314da85ec42eb54bb8414d36c7043e_amd64 |
| Red Hat | rhacm2/governance-policy-status-sync-rhel8@sha256:ff5b2b92af38f123803787b9c8b1b2dabd7f5698858aeb1a525bf47300e9f4a7_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | * |
| Red Hat | rhacm2/multicloud-manager-rhel8@sha256:bde1f105ccf6a75e4bd764fa37b14d026265e4a49725dda391afcea6ebae7b57_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/multicloud-manager-rhel8@sha256:bde1f105ccf6a75e4bd764fa37b14d026265e4a49725dda391afcea6ebae7b57_s390x |
| Red Hat | rhacm2/console-api-rhel8@sha256:b39a1006cf8fe864e179d646aad220ba52868d547e93718c3ab546db51dba2b8_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/console-api-rhel8@sha256:b39a1006cf8fe864e179d646aad220ba52868d547e93718c3ab546db51dba2b8_amd64 |
| Red Hat | rhacm2/acm-must-gather-rhel8@sha256:7e77d74de52b62d1ed97e86fc78cc46a55600788951e946a9bd4147f5a3414c0_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/acm-must-gather-rhel8@sha256:7e77d74de52b62d1ed97e86fc78cc46a55600788951e946a9bd4147f5a3414c0_amd64 |
| Red Hat | rhacm2/multicluster-operators-application-rhel8@sha256:796492e1f97bdfc1b6d1fb024b447f1042b66f3a864712299d2429e938d719b6_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/multicluster-operators-application-rhel8@sha256:796492e1f97bdfc1b6d1fb024b447f1042b66f3a864712299d2429e938d719b6_amd64 |
| Red Hat | rhacm2/search-ui-rhel8@sha256:dc8ef1c49a5beffc12701bf81ab080f089a4af0b5c247782e18bb37566739bfb_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 | rhacm2/search-ui-rhel8@sha256:dc8ef1c49a5beffc12701bf81ab080f089a4af0b5c247782e18bb37566739bfb_amd64 |
| Red Hat | rhacm2/thanos-rhel7@sha256:d1f31d391442478bdc4be5270847837ea0a6242214f66f98866d3cc89ddabeae_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 | rhacm2/thanos-rhel7@sha256:d1f31d391442478bdc4be5270847837ea0a6242214f66f98866d3cc89ddabeae_amd64 |
…and 57 more
Timeline
- Mar 14, 2022 CVE Published
- Mar 27, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2022:0856 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1999810 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2029508 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2030859 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2044556 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0856.json advisory
- https://access.redhat.com/security/cve/CVE-2021-23434 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-23434 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-23434 advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1570423 advisory
- https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1569453 advisory
- https://access.redhat.com/security/cve/CVE-2022-0155 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-0155 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-0155 advisory
- https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/ advisory