medium5.3
CVE-2020-7765
Uncontrolled Resource Consumption in firebase
Impact
This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @firebase/util | < 0.3.4 | 0.3.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Firebase\/Util | before 0.3.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/firebase/firebase-js-sdk/commit/9cf727fcc3d049551b16ae0698ac33dc2fe45ada
- https://github.com/firebase/firebase-js-sdk/pull/4001
- https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324
- https://github.com/advisories/GHSA-fpm5-vv97-jfwg
- https://nvd.nist.gov/vuln/detail/CVE-2020-7765