CVE-2020-7644: Uncontrolled Resource Consumption in fun-map
Summary
CVE-2020-7644: Uncontrolled Resource Consumption in fun-map. Affects fun-map versions < 3.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'fun-map' package is an npm package that provides a functional programming approach to working with JavaScript objects. It allows users to perform various operations on objects, such as mapping, filtering, and reducing. The package is widely used in JavaScript projects that leverage functional programming paradigms. However, versions up to 3.3.1 of 'fun-map' are vulnerable to Prototype Pollution.
Vulnerability Detail
The vulnerability in 'fun-map' is related to Prototype Pollution. Specifically, the 'assocInM' function can be manipulated to add or modify properties of 'Object.prototype' using a 'proto' payload. This can lead to unexpected behavior and potential security issues in applications that use the affected versions of 'fun-map'. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to a non-affected version of the 'fun-map' package to mitigate the risk.
Conclusion
In conclusion, the 'fun-map' package up to version 3.3.1 is vulnerable to Prototype Pollution. It is crucial for developers to update to a non-affected version of the package to mitigate the risk of unexpected behavior and potential security issues. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fun-map →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, allowing them to add or modify properties and methods of existing objects. This can lead to unexpected behavior and potential security issues.
The impact of this vulnerability depends on how the 'fun-map' package is used in the application. If the application relies on the integrity of JavaScript objects and their prototypes, the vulnerability can lead to unexpected behavior and potential security risks.
No, only versions up to 3.3.1 of 'fun-map' are affected by this vulnerability. It is recommended to update to a version higher than 3.3.1 to mitigate the risk.
Yes, the fix for this vulnerability is to update the 'fun-map' package to a version higher than 3.3.1. Developers should update the package version in their project's package.json file and run the package manager's update command.
You can find more information about this vulnerability in the GitHub Security Advisory database. The vulnerability is tracked under the identifier GHSA-p33m-7w7f-gmj8.
