Description
This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | jsonpointer | unspecified – < 5.0.0 | 5.0.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | py3.10-jsonpointer | 3.0.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | jsonpointer | < 5.0.0 | 5.0.0 | GHSA-282f-qqgm-c34q |
| npm | org.webjars.npm:json-pointer | < 5.0.0 | 5.0.0 | GHSA-282f-qqgm-c34q |