GitHub Advisoryadvisory · npm, RubyGems

GHSA-34r7-q49f-h37c Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

CRITICAL Published 2017-10-24 Modified 2021-10-29 Official page ↗
Aliases
CVE-2015-8857
Ecosystem
npm, RubyGems
Packages
uglify-js, uglifier
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1254, CWE-670
Reviewed
2020-06-16

Affected packages

• npm uglify-js: < 2.4.24 → fixed in 2.4.24 • RubyGems uglifier: < 2.7.2 → fixed in 2.7.2

Description

Versions of `uglify-js` prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification. Recommendation Upgrade UglifyJS to version >= 2.4.24.

Related

Alias · CVE (1)

  • CVE-2015-8857 The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which… vulnerability

Weakness · CWE (2)

  • CWE-1254 Incorrect Comparison Logic Granularity weakness
  • CWE-670 Always-Incorrect Control Flow Implementation weakness

References