CVE-2022-21824

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21824.json",
    "cwe_ids": [
        "CWE-471"
    ],
    "cna_assigner": "hackerone",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.0"
                },
                {
                    "fixed": "4.*"
                },
                {
                    "introduced": "5.0"
                },
                {
                    "fixed": "5.*"
                },
                {
                    "introduced": "6.0"
                },
                {
                    "fixed": "6.*"
                },
                {
                    "introduced": "7.0"
                },
                {
                    "fixed": "7.*"
                },
                {
                    "introduced": "8.0"
                },
                {
                    "fixed": "8.*"
                },
                {
                    "introduced": "9.0"
                },
                {
                    "fixed": "9.*"
                },
                {
                    "introduced": "10.0"
                },
                {
                    "fixed": "10.*"
                },
                {
                    "introduced": "11.0"
                },
                {
                    "fixed": "11.*"
                },
                {
                    "introduced": "12.0"
                },
                {
                    "fixed": "12.22.9"
                },
                {
                    "introduced": "13.0"
                },
                {
                    "fixed": "13.*"
                },
                {
                    "introduced": "14.0"
                },
                {
                    "fixed": "14.18.3"
                },
                {
                    "introduced": "15.0"
                },
                {
                    "fixed": "15.*"
                },
                {
                    "introduced": "16.0"
                },
                {
                    "fixed": "16.13.2"
                },
                {
                    "introduced": "17.0"
                },
                {
                    "fixed": "17.3.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/mysql/mysql-server

Affected ranges

Type

GIT

Repo

https://github.com/mysql/mysql-server

Events

Introduced

Last affected

8d8c986e5716e38cb776b627a8eee9e92241b4ce

Database specific

{
    "cpe": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0.29"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

mysql-3.*

mysql-3.23.22-beta

mysql-3.23.28-gamma

mysql-3.23.30-gamma

mysql-3.23.31

mysql-3.23.32

mysql-3.23.33

mysql-3.23.36

mysql-4.*

mysql-4.0.2

mysql-4.0.4

mysql-5.*

mysql-5.1.4

mysql-8.*

mysql-8.0.29

mysql-cluster-8.*

mysql-cluster-8.0.29

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-21824.json"

Git / github.com/nodejs/node

Affected ranges

Type

GIT

Repo

https://github.com/nodejs/node

Events

Introduced

2f45ad8060e13d5ac912335096d21526f2f9602b

Fixed

4e44cbfba6bbb87aa15564ea6856a556804f71c0

Introduced

73aa21658dfa6a22c06451d080152b32b1f98dbe

Fixed

92df3d654b366aa115fb672756cb051d480d8acc

Introduced

7162e686b18d22b4385fa5c04274fb04dbd810c7

Fixed

acb71eab779fb56bf70e8a9e0cb2e82a089a87de

Introduced

f99ce7c1b88ff445f60e9e5575b674cb509e47f3

Fixed

e4f326669a3f98a8804dde23eee6d8403f0a99f1

Database specific

{
    "cpe": [
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.22.9"
        },
        {
            "introduced": "14.0.0"
        },
        {
            "fixed": "14.18.3"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.13.2"
        },
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.3.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v12.*

v12.0.0

v12.1.0

v12.10.0

v12.11.0

v12.11.1

v12.12.0

v12.13.0

v12.13.1

v12.14.0

v12.14.1

v12.15.0

v12.16.0

v12.16.1

v12.16.2

v12.16.3

v12.17.0

v12.18.0

v12.18.1

v12.18.2

v12.18.3

v12.18.4

v12.19.0

v12.19.1

v12.2.0

v12.20.0

v12.20.1

v12.20.2

v12.21.0

v12.22.0

v12.22.1

v12.22.2

v12.22.3

v12.22.4

v12.22.5

v12.22.6

v12.22.7

v12.22.8

v12.3.0

v12.3.1

v12.4.0

v12.5.0

v12.6.0

v12.7.0

v12.8.0

v12.8.1

v12.9.0

v12.9.1

v14.*

v14.0.0

v14.1.0

v14.10.0

v14.10.1

v14.11.0

v14.12.0

v14.13.0

v14.13.1

v14.14.0

v14.15.0

v14.15.1

v14.15.2

v14.15.3

v14.15.4

v14.15.5

v14.16.0

v14.16.1

v14.17.0

v14.17.1

v14.17.2

v14.17.3

v14.17.4

v14.17.5

v14.17.6

v14.18.0

v14.18.1

v14.18.2

v14.2.0

v14.3.0

v14.4.0

v14.5.0

v14.6.0

v14.7.0

v14.8.0

v14.9.0

v16.*

v16.0.0

v16.1.0

v16.10.0

v16.11.0

v16.11.1

v16.12.0

v16.13.0

v16.13.1

v16.2.0

v16.3.0

v16.4.0

v16.4.1

v16.4.2

v16.5.0

v16.6.0

v16.6.1

v16.6.2

v16.7.0

v16.8.0

v16.9.0

v16.9.1

v17.*

v17.0.0

v17.0.1

v17.1.0

v17.2.0

v17.3.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-21824.json"