jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-pyusbUpgrade python3-kdcproxyUpgrade python3-qrcodeUpgrade custodiaUpgrade python3-custodiaUpgrade python3-qrcode-coreUpgrade python3-jwcryptoUpgrade python3-yubico | May 4, 2022 | Apr 20, 2019 |
| Alpine Linux | — | Upgrade drupal7Upgrade rabbitmq-server | Jun 21, 2019 | Apr 19, 2019 |
| Amazon Linux Ami 2 | — | Upgrade ipa-server-trust-adUpgrade python2-ipaclientUpgrade python2-ipaserverUpgrade ipa-server-commonUpgrade ipa-serverUpgrade ipa-commonUpgrade pcsUpgrade ipa-clientUpgrade ipa-debuginfoUpgrade ipa-python-compatUpgrade ipa-client-commonUpgrade pcs-debuginfoUpgrade ipa-server-dnsUpgrade pcs-snmpUpgrade python2-ipalib | Oct 28, 2020 | Apr 20, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 19, 2019 |
| Centos_linux | — | Upgrade pcs-debuginfoUpgrade python3-kdcproxyUpgrade pki-symkeyUpgrade javassist-javadocUpgrade ipa-python-compatUpgrade apache-commons-collectionsUpgrade ldapjdkUpgrade pki-tools-debuginfoUpgrade ipa-debugsourceUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade ipa-server-trust-ad-debuginfoUpgrade pki-kraUpgrade softhsm-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade python3-yubicoUpgrade ipa-selinuxUpgrade slapi-nis-debugsourceUpgrade apache-commons-langUpgrade pki-caUpgrade pki-toolsUpgrade ipa-client-epnUpgrade bind-dyndb-ldapUpgrade jackson-annotationsUpgrade pki-servlet-engineUpgrade pki-symkey-debuginfoUpgrade python2-ipaserverUpgrade pki-base-javaUpgrade jss-javadocUpgrade ipa-clientUpgrade pki-serverUpgrade xalan-j2Upgrade stax-exUpgrade ipa-serverUpgrade tomcatjssUpgrade ipa-client-sambaUpgrade jss-debugsourceUpgrade softhsm-develUpgrade velocityUpgrade pcs-snmpUpgrade glassfish-fastinfosetUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-healthcheckUpgrade slapi-nis-debuginfoUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade relaxngDatatypeUpgrade slf4j-jdk14Upgrade ldapjdk-javadocUpgrade xml-commons-apisUpgrade python3-jwcryptoUpgrade python3-ipaclientUpgrade python3-pkiUpgrade bind-dyndb-ldap-debuginfoUpgrade jackson-coreUpgrade ipa-commonUpgrade python3-ipaserverUpgrade xsomUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade javassistUpgrade python2-ipaclientUpgrade softhsmUpgrade xml-commons-resolverUpgrade opendnssec-debugsourceUpgrade softhsm-debugsourceUpgrade bea-stax-apiUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-apiUpgrade python2-ipalibUpgrade slapi-nisUpgrade ipa-server-debuginfoUpgrade ipa-server-trust-adUpgrade python-nss-docUpgrade jakarta-commons-httpclientUpgrade python3-qrcodeUpgrade glassfish-jaxb-runtimeUpgrade pki-baseUpgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade pki-core-debugsourceUpgrade glassfish-jaxb-txw2Upgrade ipa-server-commonUpgrade ipa-client-debuginfoUpgrade jackson-databindUpgrade python3-custodiaUpgrade xerces-j2Upgrade custodiaUpgrade jss-debuginfoUpgrade ipa-debuginfoUpgrade jssUpgrade ipa-server-dnsUpgrade opendnssecUpgrade python3-qrcode-coreUpgrade apache-commons-netUpgrade python3-pyusbUpgrade opendnssec-debuginfoUpgrade pki-core-debuginfoUpgrade python3-nssUpgrade ipa-healthcheck-coreUpgrade ipa-client-commonUpgrade python3-ipalibUpgrade pcs | Oct 1, 2020 | Apr 20, 2019 |
| Debian | — | Upgrade node-jqueryUpgrade mediawikiUpgrade otrs2 | Apr 22, 2019 | Apr 19, 2019 |
| Drupal | — | Upgrade to drupal version 8.6.1Upgrade to drupal version 7.66Upgrade to drupal version 8.5.1 | Apr 23, 2019 | Apr 19, 2019 |
| Freebsd | — | Upgrade py35-django21Upgrade py27-django111Upgrade py35-django22Upgrade py37-django22Upgrade mediawiki132Upgrade py37-django21Upgrade py37-django111Upgrade py36-django111Upgrade py36-django22Upgrade py36-django21Upgrade mediawiki131Upgrade py35-django111 | Jul 5, 2019 | Jul 5, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-symkeyUpgrade pki-serverUpgrade pki-baseUpgrade pki-caUpgrade pki-toolsUpgrade pki-kra | Feb 22, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-baseUpgrade pki-caUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-server | Apr 30, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-symkeyUpgrade pki-serverUpgrade pki-toolsUpgrade pki-base-javaUpgrade pki-caUpgrade pki-kraUpgrade pki-base | Dec 16, 2020 | Apr 20, 2019 |
| Jquery | — | Upgrade jQuery to version 3.4.0 | Apr 24, 2019 | Apr 20, 2019 |
| Oracle Solaris | — | Upgrade library/python/django-34 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade network/amqp/rabbitmq to version 3.8.3-11.4.24.0.1.75.1 on Solaris 11.4Upgrade library/python/django-37 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python-2/django-27 to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade legacy/library/python/django-35 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-26 to version 1.4.22-11.4.0.0.1.9.0 on Solaris 11.4Upgrade legacy/library/python/django-34 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-27 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python-2/django-26 to version 1.4.22-11.4.0.0.0.13.0 on Solaris 11.4Upgrade library/python-2/django to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade consolidation/osnet/osnet-incorporation to version 11.4-11.4.24.0.1.75.3 on Solaris 11.4Upgrade library/python/django to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python/django-35 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade legacy/library/python/django-27 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4 | Oct 16, 2019 | Apr 20, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 30386660 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 30108725 for version 12.1.3.0.0. | Oct 17, 2019 | Apr 20, 2019 |
| Oracle_linux | — | Upgrade glassfish-jaxb-apiUpgrade python3-qrcode-coreUpgrade pki-base-javaUpgrade jackson-annotationsUpgrade ipa-server-commonUpgrade ipa-clientUpgrade softhsmUpgrade python3-pkiUpgrade ipa-client-sambaUpgrade javassist-javadocUpgrade ipa-server-dnsUpgrade ipa-client-commonUpgrade python2-ipaclientUpgrade python3-pyusbUpgrade slapi-nisUpgrade glassfish-fastinfosetUpgrade tomcatjssUpgrade python3-ipaserverUpgrade bea-stax-apiUpgrade python3-yubicoUpgrade python2-ipalibUpgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade ipa-serverUpgrade resteasyUpgrade xalan-j2Upgrade softhsm-develUpgrade pcsUpgrade apache-commons-collectionsUpgrade apache-commons-netUpgrade ipa-server-trust-adUpgrade python3-ipalibUpgrade ipa-commonUpgrade ldapjdk-javadocUpgrade opendnssecUpgrade slf4jUpgrade velocityUpgrade pki-servlet-engineUpgrade python3-jwcryptoUpgrade python3-custodiaUpgrade ipa-python-compatUpgrade jackson-module-jaxb-annotationsUpgrade jss-javadocUpgrade bind-dyndb-ldapUpgrade javassistUpgrade pki-serverUpgrade relaxngDatatypeUpgrade apache-commons-langUpgrade ldapjdkUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade python3-qrcodeUpgrade slf4j-jdk14Upgrade ipa-client-epnUpgrade python2-ipaserverUpgrade xml-commons-apisUpgrade stax-exUpgrade jssUpgrade jackson-jaxrs-providersUpgrade ipa-selinuxUpgrade jackson-databindUpgrade xerces-j2Upgrade pki-symkeyUpgrade pki-kraUpgrade pki-toolsUpgrade pki-servlet-4.0-apiUpgrade ipa-healthcheck-coreUpgrade python-nss-docUpgrade xml-commons-resolverUpgrade pki-caUpgrade pki-baseUpgrade python3-kdcproxyUpgrade glassfish-jaxb-runtimeUpgrade jackson-coreUpgrade python3-nssUpgrade pcs-snmpUpgrade ipa-healthcheckUpgrade xsomUpgrade python3-ipaclientUpgrade custodia | Oct 7, 2020 | Mar 27, 2019 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 9.1R9 | Oct 28, 2020 | Apr 20, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 27, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Apr 20, 2019 |
| Redhat Openshift | — | Upgrade jenkinsUpgrade openshift-enterprise-autohealUpgrade openshift-ansibleUpgrade atomic-openshift-service-idlerUpgrade golang-github-prometheus-alertmanagerUpgrade atomic-openshift-dockerregistryUpgrade golang-github-prometheus-node_exporterUpgrade cri-oUpgrade atomic-enterprise-service-catalogUpgrade atomic-openshift-cluster-autoscalerUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshift-deschedulerUpgrade atomic-openshift-web-consoleUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-openshiftUpgrade golang-github-prometheus-prometheusUpgrade openshift-kuryrUpgrade atomic-openshift-metrics-serverUpgrade jenkins-2-pluginsUpgrade openshift-enterprise-cluster-capacity | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade jackson-jaxrs-providersUpgrade softhsm-develUpgrade python3-qrcode-coreUpgrade ldapjdkUpgrade python3-custodiaUpgrade python3-pkiUpgrade resteasyUpgrade slf4j-jdk14Upgrade slapi-nis-debugsourceUpgrade opendnssec-debuginfoUpgrade opendnssecUpgrade xmlstreambufferUpgrade pki-servlet-engineUpgrade bind-dyndb-ldap-debuginfoUpgrade apache-commons-langUpgrade velocityUpgrade ipa-serverUpgrade ipa-client-debuginfoUpgrade xerces-j2Upgrade pki-tools-debuginfoUpgrade glassfish-jaxb-apiUpgrade python3-yubicoUpgrade slapi-nisUpgrade ipa-server-trust-adUpgrade ipa-client-epnUpgrade python3-ipaserverUpgrade pki-base-javaUpgrade ipa-clientUpgrade ipa-server-dnsUpgrade python2-ipaclientUpgrade ipa-debuginfoUpgrade pki-symkey-debuginfoUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsNo solution existsUpgrade python3-jwcryptoUpgrade slapi-nis-debuginfoUpgrade python3-pyusbUpgrade ipa-client-commonUpgrade softhsm-debugsourceUpgrade ldapjdk-javadocUpgrade pcs-snmpUpgrade tomcatjssUpgrade ipa-python-compatUpgrade stax-exUpgrade bea-stax-apiUpgrade jss-javadocUpgrade python2-ipalibUpgrade ipa-server-debuginfoUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade ipa-commonUpgrade jakarta-commons-httpclientUpgrade javassistUpgrade softhsmUpgrade slf4jUpgrade pcs-debuginfoUpgrade custodiaUpgrade python-nss-debugsourceUpgrade python3-qrcodeUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade bind-dyndb-ldapUpgrade jackson-databindUpgrade opendnssec-debugsourceUpgrade pki-serverUpgrade pki-kraUpgrade ipa-debugsourceUpgrade python3-nssUpgrade python3-ipalibUpgrade jackson-coreUpgrade ipa-server-trust-ad-debuginfoUpgrade xalan-j2Upgrade pki-core-debuginfoUpgrade python2-ipaserverUpgrade ipa-selinuxUpgrade softhsm-debuginfoUpgrade jss-debuginfoUpgrade pcsUpgrade ipa-healthcheck-coreUpgrade python3-nss-debuginfoUpgrade jss-debugsourceUpgrade glassfish-jaxb-txw2Upgrade python3-kdcproxyUpgrade python3-ipaclientUpgrade xsomUpgrade pki-baseUpgrade ipa-client-sambaUpgrade apache-commons-netUpgrade pki-toolsUpgrade pki-servlet-4.0-apiUpgrade ipa-healthcheckUpgrade pki-symkeyUpgrade pki-caUpgrade ipa-server-commonUpgrade javassist-javadocUpgrade jssUpgrade python-nss-docUpgrade relaxngDatatypeUpgrade bind-dyndb-ldap-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade jackson-annotationsUpgrade jackson-jaxrs-json-providerUpgrade pki-core-debugsource | Oct 1, 2020 | Apr 20, 2019 |
| Rocky_linux | — | Upgrade pcsUpgrade python3-nssUpgrade python-nss-docUpgrade pcs-snmpUpgrade python3-nss-debuginfoUpgrade python-nss-debugsource | Mar 12, 2024 | Apr 20, 2019 |
| Suse | — | Upgrade python3-django | Aug 9, 2019 | Apr 19, 2019 |
| Ubuntu | — | Upgrade libjs-jquery (Ubuntu Pro) | Jun 26, 2025 | Apr 20, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub