jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-qrcodeUpgrade python3-pyusbUpgrade python3-kdcproxyUpgrade python3-custodiaUpgrade python3-qrcode-coreUpgrade python3-yubicoUpgrade python3-jwcryptoUpgrade custodia | May 4, 2022 | Apr 20, 2019 |
| Alpine Linux | — | Upgrade rabbitmq-serverUpgrade drupal7 | Jun 21, 2019 | Apr 19, 2019 |
| Amazon Linux Ami 2 | — | Upgrade ipa-commonUpgrade pcs-debuginfoUpgrade python2-ipalibUpgrade ipa-debuginfoUpgrade ipa-client-commonUpgrade ipa-python-compatUpgrade python2-ipaserverUpgrade ipa-server-commonUpgrade python2-ipaclientUpgrade ipa-server-trust-adUpgrade ipa-serverUpgrade pcs-snmpUpgrade pcsUpgrade ipa-clientUpgrade ipa-server-dns | Oct 28, 2020 | Apr 20, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 19, 2019 |
| Centos_linux | — | Upgrade javassist-javadocUpgrade glassfish-jaxb-apiUpgrade python3-nssUpgrade ipa-debugsourceUpgrade jakarta-commons-httpclientUpgrade slapi-nisUpgrade pki-core-debugsourceUpgrade python3-kdcproxyUpgrade ipa-server-trust-adUpgrade pki-core-debuginfoUpgrade softhsm-debugsourceUpgrade custodiaUpgrade python3-ipalibUpgrade softhsmUpgrade opendnssec-debugsourceUpgrade glassfish-jaxb-txw2Upgrade python2-ipaclientUpgrade xml-commons-resolverUpgrade pcsUpgrade ipa-server-commonUpgrade pki-baseUpgrade python-nss-docUpgrade pki-servlet-4.0-apiUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade jackson-databindUpgrade pki-symkeyUpgrade python3-qrcodeUpgrade python3-pyusbUpgrade python3-qrcode-coreUpgrade ipa-server-dnsUpgrade ipa-client-commonUpgrade javassistUpgrade apache-commons-netUpgrade ipa-healthcheck-coreUpgrade jssUpgrade pki-tools-debuginfoUpgrade python2-ipalibUpgrade ldapjdkUpgrade xerces-j2Upgrade bea-stax-apiUpgrade opendnssecUpgrade opendnssec-debuginfoUpgrade ipa-python-compatUpgrade jss-debuginfoUpgrade ipa-server-debuginfoUpgrade python3-custodiaUpgrade glassfish-jaxb-runtimeUpgrade pcs-debuginfoUpgrade xmlstreambufferUpgrade ipa-client-debuginfoUpgrade ipa-debuginfoUpgrade slapi-nis-debugsourceUpgrade ipa-server-trust-ad-debuginfoUpgrade pki-kraUpgrade python3-jwcryptoUpgrade python3-yubicoUpgrade bind-dyndb-ldapUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-clientUpgrade jackson-jaxrs-providersUpgrade python2-ipaserverUpgrade python3-pkiUpgrade slf4jUpgrade glassfish-fastinfosetUpgrade apache-commons-langUpgrade ipa-selinuxUpgrade jackson-jaxrs-json-providerUpgrade xsomUpgrade softhsm-debuginfoUpgrade resteasyUpgrade python3-ipaclientUpgrade pki-toolsUpgrade jackson-module-jaxb-annotationsUpgrade python3-nss-debuginfoUpgrade jackson-annotationsUpgrade ipa-commonUpgrade relaxngDatatypeUpgrade xalan-j2Upgrade bind-dyndb-ldap-debuginfoUpgrade xml-commons-apisUpgrade python3-ipaserverUpgrade ldapjdk-javadocUpgrade softhsm-develUpgrade ipa-serverUpgrade slf4j-jdk14Upgrade jss-debugsourceUpgrade pki-caUpgrade pki-serverUpgrade ipa-healthcheckUpgrade velocityUpgrade jackson-coreUpgrade ipa-client-epnUpgrade python-nss-debugsourceUpgrade jss-javadocUpgrade pcs-snmpUpgrade stax-exUpgrade pki-base-javaUpgrade tomcatjssUpgrade ipa-client-sambaUpgrade pki-symkey-debuginfoUpgrade slapi-nis-debuginfoUpgrade pki-servlet-engine | Oct 1, 2020 | Apr 20, 2019 |
| Debian | — | Upgrade node-jqueryUpgrade mediawikiUpgrade otrs2 | Apr 22, 2019 | Apr 19, 2019 |
| Drupal | — | Upgrade to drupal version 7.66Upgrade to drupal version 8.6.1Upgrade to drupal version 8.5.1 | Apr 23, 2019 | Apr 19, 2019 |
| Freebsd | — | Upgrade py37-django21Upgrade py36-django111Upgrade py36-django22Upgrade py35-django111Upgrade py36-django21Upgrade mediawiki131Upgrade py37-django111Upgrade py27-django111Upgrade mediawiki132Upgrade py35-django22Upgrade py37-django22Upgrade py35-django21 | Jul 5, 2019 | Jul 5, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-toolsUpgrade pki-kraUpgrade pki-serverUpgrade pki-caUpgrade pki-baseUpgrade pki-symkey | Feb 22, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-baseUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-caUpgrade pki-tools | Apr 30, 2021 | Apr 20, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-toolsUpgrade pki-caUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-kraUpgrade pki-base | Dec 16, 2020 | Apr 20, 2019 |
| Jquery | — | Upgrade jQuery to version 3.4.0 | Apr 24, 2019 | Apr 20, 2019 |
| Oracle Solaris | — | Upgrade library/python/django to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python-2/django to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade legacy/library/python/django-27 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade consolidation/osnet/osnet-incorporation to version 11.4-11.4.24.0.1.75.3 on Solaris 11.4Upgrade library/python/django-27 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade library/python/django-26 to version 1.4.22-11.4.0.0.1.9.0 on Solaris 11.4Upgrade legacy/library/python/django-34 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python-2/django-26 to version 1.4.22-11.4.0.0.0.13.0 on Solaris 11.4Upgrade library/python/django-35 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade legacy/library/python/django-35 to version 1.11.29-11.4.21.0.1.69.0 on Solaris 11.4Upgrade library/python/django-34 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4Upgrade network/amqp/rabbitmq to version 3.8.3-11.4.24.0.1.75.1 on Solaris 11.4Upgrade library/python-2/django-27 to version 1.4.10-11.4.0.0.1.9.0 on Solaris 11.4Upgrade library/python/django-37 to version 1.11.23-11.4.14.0.1.3.0 on Solaris 11.4 | Oct 16, 2019 | Apr 20, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 30108725 for version 12.1.3.0.0.Apply the Patch Set Update (PSU) 30386660 for version 12.2.1.3.0. | Oct 17, 2019 | Apr 20, 2019 |
| Oracle_linux | — | Upgrade python3-custodiaUpgrade pki-serverUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade ldapjdkUpgrade jakarta-commons-httpclientUpgrade python2-ipaclientUpgrade softhsmUpgrade apache-commons-langUpgrade python2-ipalibUpgrade ipa-client-commonUpgrade slf4jUpgrade velocityUpgrade ldapjdk-javadocUpgrade glassfish-fastinfosetUpgrade ipa-server-commonUpgrade glassfish-jaxb-apiUpgrade python3-qrcode-coreUpgrade python3-pkiUpgrade python3-jwcryptoUpgrade pki-servlet-engineUpgrade jackson-module-jaxb-annotationsUpgrade python3-ipalibUpgrade ipa-clientUpgrade ipa-python-compatUpgrade resteasyUpgrade jackson-annotationsUpgrade ipa-client-sambaUpgrade jss-javadocUpgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade xalan-j2Upgrade pcsUpgrade ipa-server-dnsUpgrade softhsm-develUpgrade opendnssecUpgrade python3-yubicoUpgrade javassistUpgrade apache-commons-netUpgrade ipa-server-trust-adUpgrade slapi-nisUpgrade bea-stax-apiUpgrade pki-base-javaUpgrade glassfish-jaxb-txw2Upgrade python3-pyusbUpgrade bind-dyndb-ldapUpgrade python3-ipaserverUpgrade tomcatjssUpgrade ipa-serverUpgrade ipa-commonUpgrade jssUpgrade python2-ipaserverUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade python3-ipaclientUpgrade xml-commons-apisUpgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade python3-qrcodeUpgrade ipa-selinuxUpgrade glassfish-jaxb-runtimeUpgrade pki-toolsUpgrade ipa-client-epnUpgrade python3-nssUpgrade jackson-coreUpgrade ipa-healthcheck-coreUpgrade xml-commons-resolverUpgrade pki-baseUpgrade pcs-snmpUpgrade pki-caUpgrade jackson-jaxrs-providersUpgrade jackson-jaxrs-json-providerUpgrade pki-symkeyUpgrade xerces-j2Upgrade pki-kraUpgrade python-nss-docUpgrade python3-kdcproxyUpgrade stax-exUpgrade xsomUpgrade ipa-healthcheckUpgrade custodia | Oct 7, 2020 | Mar 27, 2019 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 9.1R9 | Oct 28, 2020 | Apr 20, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 27, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Apr 20, 2019 |
| Redhat Openshift | — | Upgrade atomic-openshift-web-consoleUpgrade openshift-kuryrUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshift-metrics-serverUpgrade atomic-openshiftUpgrade atomic-openshift-cluster-autoscalerUpgrade jenkins-2-pluginsUpgrade atomic-openshift-deschedulerUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-enterprise-service-catalogUpgrade golang-github-prometheus-prometheusUpgrade cri-oUpgrade openshift-enterprise-cluster-capacityUpgrade openshift-ansibleUpgrade golang-github-prometheus-alertmanagerUpgrade atomic-openshift-service-idlerUpgrade atomic-openshift-dockerregistryUpgrade openshift-enterprise-autohealUpgrade golang-github-prometheus-node_exporterUpgrade jenkins | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade xml-commons-resolverUpgrade bind-dyndb-ldapUpgrade opendnssec-debugsourceUpgrade slf4jUpgrade bind-dyndb-ldap-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade custodiaUpgrade python-nss-docUpgrade pki-core-debugsourceUpgrade jackson-annotationsUpgrade jackson-jaxrs-json-providerUpgrade pcs-debuginfoUpgrade jackson-databindUpgrade jss-debuginfoUpgrade ipa-healthcheck-coreUpgrade softhsm-debuginfoUpgrade python2-ipaserverUpgrade python3-qrcodeUpgrade python3-ipalibUpgrade pcsUpgrade ipa-healthcheckUpgrade xalan-j2Upgrade pki-toolsUpgrade ipa-server-commonUpgrade python-nss-debugsourceUpgrade ipa-client-sambaUpgrade pki-kraUpgrade python3-nssUpgrade ipa-server-trust-ad-debuginfoUpgrade pki-baseUpgrade pki-serverUpgrade python3-kdcproxyUpgrade pki-core-debuginfoUpgrade ipa-selinuxUpgrade jss-debugsourceUpgrade pki-symkeyUpgrade pki-caUpgrade python3-ipaclientUpgrade apache-commons-netUpgrade xsomUpgrade jackson-coreUpgrade ipa-debugsourceUpgrade jssUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade python3-nss-debuginfoUpgrade pki-servlet-4.0-apiUpgrade javassistUpgrade jss-javadocUpgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade slapi-nis-debugsourceUpgrade ipa-clientUpgrade ipa-server-dnsNo solution existsUpgrade softhsm-debugsourceUpgrade slapi-nisUpgrade glassfish-fastinfosetUpgrade xmlstreambufferUpgrade pki-tools-debuginfoUpgrade python3-yubicoUpgrade python3-ipaserverUpgrade ipa-server-trust-adUpgrade ipa-client-epnUpgrade python3-pyusbUpgrade python3-jwcryptoUpgrade xerces-j2Upgrade ipa-client-debuginfoUpgrade slapi-nis-debuginfoUpgrade resteasyUpgrade pcs-snmpUpgrade opendnssec-debuginfoUpgrade bea-stax-apiUpgrade ipa-client-commonUpgrade python3-custodiaUpgrade ldapjdk-javadocUpgrade ipa-commonUpgrade opendnssecUpgrade tomcatjssUpgrade jackson-jaxrs-providersUpgrade pki-symkey-debuginfoUpgrade pki-base-javaUpgrade ipa-serverUpgrade python2-ipaclientUpgrade ipa-debuginfoUpgrade stax-exUpgrade ldapjdkUpgrade python3-pkiUpgrade jackson-module-jaxb-annotationsUpgrade python2-ipalibUpgrade velocityUpgrade ipa-server-debuginfoUpgrade softhsm-develUpgrade glassfish-jaxb-coreUpgrade softhsmUpgrade slf4j-jdk14Upgrade xml-commons-apisUpgrade jakarta-commons-httpclientUpgrade bind-dyndb-ldap-debuginfoUpgrade pki-servlet-engineUpgrade ipa-python-compatUpgrade python3-qrcode-core | Oct 1, 2020 | Apr 20, 2019 |
| Rocky_linux | — | Upgrade pcsUpgrade python-nss-docUpgrade python3-nssUpgrade pcs-snmpUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | Apr 20, 2019 |
| Suse | — | Upgrade python3-django | Aug 9, 2019 | Apr 19, 2019 |
| Ubuntu | — | Upgrade libjs-jquery (Ubuntu Pro) | Jun 26, 2025 | Apr 20, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub