Back Linuxsecurity Ubuntu 22.04 Dottie Critical Remote Code Execution USN-8041
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Dottie could be made to run programs if it received specially crafted network traffic. Software Description: - node-dottie: Fast and safe nested object access and manipulation in JavaScript Details: Yuhan Gao and Peng Zhou discovered that Dottie was vulnerable to prototype pollution when altering the __proto__ magical attribute. An attacker could possibly use this issue to achieve remote code execution.
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Dottie could be made to run programs if it received specially crafted network traffic. Software Description: - node-dottie: Fast and safe nested object access and manipulation in JavaScript Details: Yuhan Gao and Peng Zhou discovered that Dottie was vulnerable to prototype pollution when altering the __proto__ magical attribute. An attacker could possibly use this issue to achieve remote code execution.
The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS node-dottie 2.0.2-4ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS node-dottie 2.0.2-1ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.
The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS node-dottie 2.0.2-4ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS node-dottie 2.0.2-1ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
