[GHSA-35jh-r3h4-6jhm] Command Injection in lodash #5977
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR updates a GitHub Security Advisory (GHSA-35jh-r3h4-6jhm) for a command injection vulnerability in lodash to include an additional affected package. The update adds lodash-rails to the list of impacted RubyGems packages and updates the modification timestamp.
- Added
lodash-railsRubyGems package to the affected products list - Updated the modification timestamp to reflect the change
| "introduced": "0" | ||
| }, | ||
| { | ||
| "fixed": "4.17.21" |
There was a problem hiding this comment.
The fixed version '4.17.21' appears to be a JavaScript npm version for lodash, but this is being applied to the RubyGems package 'lodash-rails'. RubyGems packages typically have different versioning schemes than their JavaScript counterparts. Please verify that version 4.17.21 is a valid and correct version for the lodash-rails RubyGems package.
| "fixed": "4.17.21" |
Copilot uses AI. Check for mistakes.
There was a problem hiding this comment.
It is the correct version - the gems versioning matches the version of lodash that it provides (at least in the 4.x line)
github-actions
bot
changed the base branch from
main
to
G-Rath/advisory-improvement-5977
advisory-database
bot
merged commit 6c3d5fa
into
G-Rath/advisory-improvement-5977
|
Hi @G-Rath! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
Added
lodash-railsto list of impacted packages