Version in base suite: 6.0.2+dfsg-1 Base version: node-kind-of_6.0.2+dfsg-1 Target version: node-kind-of_6.0.2+dfsg-1+deb10u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/n/node-kind-of/node-kind-of_6.0.2+dfsg-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/n/node-kind-of/node-kind-of_6.0.2+dfsg-1+deb10u1.dsc changelog | 7 +++++++ patches/CVE-2019-20149.diff | 20 ++++++++++++++++++++ patches/series | 1 + 3 files changed, 28 insertions(+) diff -Nru node-kind-of-6.0.2+dfsg/debian/changelog node-kind-of-6.0.2+dfsg/debian/changelog --- node-kind-of-6.0.2+dfsg/debian/changelog 2018-01-11 17:25:37.000000000 +0000 +++ node-kind-of-6.0.2+dfsg/debian/changelog 2020-01-17 05:19:37.000000000 +0000 @@ -1,3 +1,10 @@ +node-kind-of (6.0.2+dfsg-1+deb10u1) buster; urgency=medium + + * Team upload + * fix type checking vul in ctorName (Closes: #948095, CVE-2019-20149) + + -- Xavier Guimard Fri, 17 Jan 2020 06:19:37 +0100 + node-kind-of (6.0.2+dfsg-1) unstable; urgency=medium * Team upload diff -Nru node-kind-of-6.0.2+dfsg/debian/patches/CVE-2019-20149.diff node-kind-of-6.0.2+dfsg/debian/patches/CVE-2019-20149.diff --- node-kind-of-6.0.2+dfsg/debian/patches/CVE-2019-20149.diff 1970-01-01 00:00:00.000000000 +0000 +++ node-kind-of-6.0.2+dfsg/debian/patches/CVE-2019-20149.diff 2020-01-17 05:19:37.000000000 +0000 @@ -0,0 +1,20 @@ +Description: fix type checking vul in ctorName + CVE-2019-20149 +Author: Brian Woodward +Bug: https://github.com/jonschlinkert/kind-of/pull/30 +Bug-Debian: https://bugs.debian.org/948095 +Forwarded: not-needed +Reviewed-By: Xavier Guimard +Last-Update: 2020-01-17 + +--- a/index.js ++++ b/index.js +@@ -66,7 +66,7 @@ + }; + + function ctorName(val) { +- return val.constructor ? val.constructor.name : null; ++ return typeof val.constructor === 'function' ? val.constructor.name : null; + } + + function isArray(val) { diff -Nru node-kind-of-6.0.2+dfsg/debian/patches/series node-kind-of-6.0.2+dfsg/debian/patches/series --- node-kind-of-6.0.2+dfsg/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ node-kind-of-6.0.2+dfsg/debian/patches/series 2020-01-17 05:19:37.000000000 +0000 @@ -0,0 +1 @@ +CVE-2019-20149.diff