CVE-2020-5258: Debian Linux

High severity, CVSS 7.7. EPSS: 4% chance of exploitation in the next 30 days.

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

Affected products

Debian Debian Linux: version 8.0 only
Linuxfoundation Dojo: before 1.11.10 (fixed in 1.11.10); from 1.12.0, before 1.12.8 (fixed in 1.12.8); from 1.13.0, before 1.13.7 (fixed in 1.13.7); from 1.14.0, before 1.14.6 (fixed in 1.14.6); from 1.15.0, before 1.15.3 (fixed in 1.15.3); from 1.16.0, before 1.16.2 (fixed in 1.16.2)
Oracle Communications Application Session Controller: version 3.9.0 only
Oracle Communications Policy Management: version 12.5.0 only
Oracle Communications Pricing Design Center: version 12.0.0.3.0 only
Oracle Documaker: from 12.6.0, up to and including 12.6.4
Oracle MySQL: from 7.3.0, up to and including 7.3.29; from 7.4.0, up to and including 7.4.28; from 7.5.0, up to and including 7.5.18; from 7.6.0, up to and including 7.6.14; from 8.0.0, up to and including 8.0.20
Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only
Oracle Webcenter Sites: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle WebLogic Server: version 12.2.1.4.0 only; version 14.1.1.0.0 only

Published 2020-03-10. Last modified 2026-10-08.