CVE-2019-20149

A flaw was found in nodejs-kind-of. An external user is allowed input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

While some components do package a vulnerable version of kind-of, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. This applies to the following products:

• OpenShift ServiceMesh (OSSM)
• Red Hat Advanced Cluster Management for Kubernetes (RHACM)
• OpenShift distributed tracing
• OpenShift Data Foundation

In Openshift Container Platform (OCP) 4.6 the openshift4/ose-logging-kibana container delivers a vulnerable version of kind-of, however OCP 4.6 is Out Of Support Scope (OOSS) for Moderate and Low impact vulnerabilities. Since the release of OCP 4.7 this component is now delivered as part of the OpenShift Logging product (openshift-logging/kibana6-rhel8 container). Further, OCP 3.11 has been set to Will not fix, as OCP 3.11 is moving into maintenance phase of support.

In Red Hat Virtualization some components do package a version of kind-of, however none use an affected version (later than 6.0.0, prior to 6.0.3)

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.