{
  "threat_severity" : "Important",
  "public_date" : "2021-09-01T00:00:00Z",
  "bugzilla" : {
    "description" : "immer: type confusion vulnerability can lead to a bypass of CVE-2020-28477",
    "id" : "2041833",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2041833"
  },
  "cvss3" : {
    "cvss3_base_score" : "9.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "details" : [ "This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === \"__proto__\" || p === \"constructor\") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.", "A prototype pollution flaw was found in the Node.js immer module. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, an attacker could execute arbitrary code on the system." ],
  "affected_release" : [ {
    "product_name" : "RHPAM 7.13.1 async",
    "release_date" : "2022-10-05T00:00:00Z",
    "advisory" : "RHSA-2022:6813",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "immer",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Process Automation 7",
    "fix_state" : "Out of support scope",
    "package_name" : "immer",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
    "impact" : "low"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2021-23436\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-23436" ],
  "name" : "CVE-2021-23436",
  "csaw" : false
}