Red Hat Security Advisory: Red Hat Mobile Application Platform 4.6.0 release - RPMs

Fixed packages 87

Vulnerabilities 2

• High 8.8
  CVE-2018-3728

  Prototype Pollution in hoek

  hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causi…

  @hapi hoek node module hoek node-hoek Debian Ubuntu npm
  Mar 30, 2018
• High 7.5
  CVE-2017-15010

  Regular Expression Denial of Service in tough-cookie

  A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CP…

  tough-cookie node-tough-cookie node-tough-cookie Debian Ubuntu npm
  Oct 3, 2017

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1493989
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1545893
• article
  https://issues.redhat.com/browse/RHMAP-19902
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1263.json
• report
  https://access.redhat.com/security/cve/CVE-2017-15010
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-15010
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-15010
• article
  https://nodesecurity.io/advisories/525
• report
  https://access.redhat.com/security/cve/CVE-2018-3728
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-3728
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-3728