What is GHSA-34r7-q49f-h37c?

GHSA-34r7-q49f-h37c is a security advisory published by GitHub Security Advisories with Critical severity. Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

Which CVE IDs does GHSA-34r7-q49f-h37c cover?

GHSA-34r7-q49f-h37c covers the following CVE IDs: CVE-2015-8857. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-34r7-q49f-h37c?

GHSA-34r7-q49f-h37c has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-34r7-q49f-h37c?

GHSA-34r7-q49f-h37c affects 2 products, including: npm/uglify-js:\u003c 2.4.24; rubygems/uglifier:\u003c 2.7.2.

GHSA-34r7-q49f-h37cCriticalCVSS 9.8

Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

Vendor

GitHub Security Advisories

Published

October 24, 2017

Last Modified

April 12, 2023

🔗 CVE IDs covered (1)

CVE-2015-8857 →

📋 Description

Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.

Recommendation

Upgrade UglifyJS to version >= 2.4.24.

🎯 Affected products2

npm/uglify-js:< 2.4.24
rubygems/uglifier:< 2.7.2

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2015-8857
https://github.com/mishoo/UglifyJS2/issues/751
https://zyan.scripts.mit.edu/blog/backdooring-js/
http://www.openwall.com/lists/oss-security/2016/04/20/11
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/CVE-2015-8857.yml
https://web.archive.org/web/20200227190830/http://www.securityfocus.com/bid/96410
https://github.com/lautis/uglifier/commit/4677bfe38142937ff952f95605bcec4618892c3e
https://github.com/advisories/GHSA-34r7-q49f-h37c