요약
- CVE-2024-23339은(는) hoolock (elijahharry), hoolock에 영향을 주는 보통 (CVSS 6.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 1.0%, 전체 취약점의 63.2%보다 높음.
- 조치: 2.2.1 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| hoolock | ≥ 2.0.0, < 2.2.1
| 2.2.1
|
| hoolock npm | ≥ 2.0.0, < 2.2.1
| 2.2.1
|
Description
Impact
Utility functions related to object paths (get, set and update) did not block attempts to access or alter object prototypes.
Patches
The get, set and update functions will throw a TypeError when a user attempts to access or alter inherited properties in versions >=2.2.1.
NVD description
hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility functions related to object paths (`get`, `set`, and `update`) did not block attempts to access or alter object prototypes. Starting in version 2.2.1, the `get`, `set` and `update` functions throw a `TypeError` when a user attempts to access or alter inherited properties.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free