Advisory
A note with CVSS 4.3 for component HAN-DB-CLI was released by SAP on 08.10.2024. The correction/advisory 3520100 was described with "[CVE-2024-45277] Prototype Pollution vulnerability in SAP HANA Client" and affects the system type SAP HANA Client.
A workaround exists, according to SAP Security Advisory team. It is advisable to implement the correction as none.
The vulnerability addressed is prototype pollution within SAP HANA Client.
Risk specification
Prototype Pollution may occur when using the nestTables option and __proto__ as a table name.Solution
An error is now reported when an application attempts to use the nestTables option on a table named __proto__. This issue is fixed in the patches listed in the “Support Packages & Patches”. Although an alternative solution exists, it is advisable to apply the correction! This is the workaround, which was suggested by the SAP security experts: "Please assess the workaround applicability for your SAP landscape prior to implementation. Note that this workaround is a temporary fix and is not a permanent solution. SAP strongly recommends you apply the corrections outlin ed in the security note, which can be done in lieu of the workaround or after the workaround is implemented. Don't use nestTables and/or don't use __proto__ as a table name.".
The advisory is valid for
- HDB_CLIENT 2.0
