CVE-2020-7677

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2020-7677
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7677.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-7677
Aliases
Related
Published
2022-07-25T14:15:10Z
Modified
2024-09-18T03:11:31.696113Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

References

Affected packages

Debian:11 / node-thenify

Package

Name
node-thenify
Purl
pkg:deb/debian/node-thenify?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.3.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / node-thenify

Package

Name
node-thenify
Purl
pkg:deb/debian/node-thenify?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.3.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / node-thenify

Package

Name
node-thenify
Purl
pkg:deb/debian/node-thenify?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.3.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/thenables/thenify

Affected ranges

Type
GIT
Repo
https://github.com/thenables/thenify
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0d94a24eb933bc835d568f3009f4d269c4c4c17a

Affected versions

2.*

2.0.0

3.*

3.0.0
3.1.0
3.1.1
3.2.0
3.2.1
3.3.0