Skip to content

Commit dfcf81a

Browse files
jasnowpostmodern
jasnow
authored and
postmodern
committed
GHSA SYNC: 7 brand new advisories
1 parent 43149b5 commit dfcf81a

File tree

7 files changed

+253
-0
lines changed

7 files changed

+253
-0
lines changed

‎gems/lodash-rails/CVE-2018-16487.yml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
gem: lodash-rails
3+
cve: 2018-16487
4+
ghsa: 4xc9-xhrj-v574
5+
url: https://github.com/advisories/GHSA-4xc9-xhrj-v574
6+
title: Prototype Pollution in lodash
7+
date: 2019-02-07
8+
description: |
9+
Versions of `lodash` before 4.17.11 are vulnerable to
10+
prototype pollution.
11+
12+
The vulnerable functions are 'defaultsDeep', 'merge', and
13+
'mergeWith' which allow a malicious user to modify the
14+
prototype of `Object` via `{constructor: {prototype:
15+
{...}}}` causing the addition or modification of an existing
16+
property that will exist on all objects.
17+
18+
## Recommendation
19+
20+
Update to version 4.17.11 or later.
21+
cvss_v2: 6.8
22+
cvss_v3: 5.6
23+
patched_versions:
24+
- ">= 4.17.11"
25+
related:
26+
url:
27+
- https://nvd.nist.gov/vuln/detail/CVE-2018-16487
28+
- https://hackerone.com/reports/380873
29+
- https://www.npmjs.com/advisories/782
30+
- https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad
31+
- https://security.netapp.com/advisory/ntap-20190919-0004
32+
- https://github.com/advisories/GHSA-4xc9-xhrj-v574

‎gems/lodash-rails/CVE-2018-3721.yml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
gem: lodash-rails
3+
cve: 2018-3721
4+
ghsa: fvqr-27wr-82fm
5+
url: https://github.com/advisories/GHSA-fvqr-27wr-82fm
6+
title: Prototype Pollution in lodash
7+
date: 2018-07-26
8+
description: |
9+
Versions of `lodash` before 4.17.5 are vulnerable to
10+
prototype pollution.
11+
12+
The vulnerable functions are 'defaultsDeep', 'merge', and
13+
'mergeWith' which allow a malicious user to modify the
14+
prototype of `Object` via `__proto__` causing the addition
15+
or modification of an existing property that will exist
16+
on all objects.
17+
18+
## Recommendation
19+
20+
Update to version 4.17.5 or later."
21+
cvss_v2: 4.0
22+
cvss_v3: 6.5
23+
patched_versions:
24+
- ">= 4.17.5"
25+
related:
26+
url:
27+
- https://nvd.nist.gov/vuln/detail/CVE-2018-3721
28+
- https://hackerone.com/reports/310443
29+
- https://www.npmjs.com/advisories/577
30+
- https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a
31+
- https://security.netapp.com/advisory/ntap-20190919-0004
32+
- https://github.com/advisories/GHSA-fvqr-27wr-82fm

‎gems/lodash-rails/CVE-2019-1010266.yml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
gem: lodash-rails
3+
cve: 2019-1010266
4+
ghsa: x5rq-j2xg-h7qm
5+
url: https://github.com/advisories/GHSA-x5rq-j2xg-h7qm
6+
title: Regular Expression Denial of Service (ReDoS) in lodash
7+
date: 2019-07-19
8+
description: |
9+
lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled
10+
Resource Consumption. The impact is: Denial of service. The
11+
component is: Date handler. The attack vector is: Attacker
12+
provides very long strings, which the library attempts
13+
to match using a regular expression.
14+
15+
The fixed version is: 4.7.11.
16+
patched_versions:
17+
- ">= 4.17.11"
18+
related:
19+
url:
20+
- https://nvd.nist.gov/vuln/detail/CVE-2019-1010266
21+
- https://github.com/lodash/lodash/issues/3359
22+
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
23+
- https://github.com/lodash/lodash/commit/5c08f18d365b64063bfbfa686cbb97cdd6267347
24+
- https://github.com/lodash/lodash/wiki/Changelog
25+
- https://security.netapp.com/advisory/ntap-20190919-0004
26+
- https://github.com/advisories/GHSA-x5rq-j2xg-h7qm

‎gems/lodash-rails/CVE-2019-10744.yml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
gem: lodash-rails
3+
cve: 2019-10744
4+
ghsa: jf85-cpcp-j695
5+
url: https://github.com/advisories/GHSA-jf85-cpcp-j695
6+
title: Prototype Pollution in lodash
7+
date: 2019-07-10
8+
description: |
9+
Versions of `lodash` before 4.17.12 are vulnerable to Prototype
10+
Pollution. The function `defaultsDeep` allows a malicious user
11+
to modify the prototype of `Object` via
12+
`{constructor: {prototype: {...}}}` causing the addition or
13+
modification of an existing property that will exist on all objects.
14+
15+
## Recommendation
16+
17+
Update to version 4.17.12 or later.
18+
cvss_v2: 6.4
19+
cvss_v3: 9.1
20+
patched_versions:
21+
- ">= 4.17.12"
22+
related:
23+
url:
24+
- https://nvd.nist.gov/vuln/detail/CVE-2019-10744
25+
- https://github.com/lodash/lodash/pull/4336
26+
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
27+
- https://www.npmjs.com/advisories/1065
28+
- https://access.redhat.com/errata/RHSA-2019:3024
29+
- https://support.f5.com/csp/article/K47105354
30+
- https://www.oracle.com/security-alerts/cpujan2021.html
31+
- https://www.oracle.com/security-alerts/cpuoct2020.html
32+
- https://security.netapp.com/advisory/ntap-20191004-0005
33+
- https://github.com/advisories/GHSA-jf85-cpcp-j695

‎gems/lodash-rails/CVE-2020-28500.yml

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
gem: lodash-rails
3+
cve: 2020-28500
4+
ghsa: 29mw-wpgm-hmr9
5+
url: https://github.com/advisories/GHSA-29mw-wpgm-hmr9
6+
title: Regular Expression Denial of Service (ReDoS) in lodash
7+
date: 2022-01-06
8+
description: |
9+
All versions of package lodash prior to 4.17.21 are vulnerable
10+
to Regular Expression Denial of Service (ReDoS) via the
11+
`toNumber`, `trim` and `trimEnd` functions.
12+
13+
Steps to reproduce (provided by reporter Liyuan Chen):
14+
15+
```
16+
var lo = require('lodash');
17+
18+
function build_blank(n) {
19+
var ret = "1"
20+
for (var i = 0; i < n; i++) {
21+
ret += " "
22+
}
23+
return ret + "1";
24+
}
25+
var s = build_blank(50000) var time0 = Date.now();
26+
lo.trim(s)
27+
var time_cost0 = Date.now() - time0;
28+
console.log("time_cost0: " + time_cost0);
29+
var time1 = Date.now();
30+
lo.toNumber(s) var time_cost1 = Date.now() - time1;
31+
console.log("time_cost1: " + time_cost1);
32+
var time2 = Date.now();
33+
lo.trimEnd(s);
34+
var time_cost2 = Date.now() - time2;
35+
console.log("time_cost2: " + time_cost2);
36+
```
37+
cvss_v2: 5.0
38+
cvss_v3: 5.3
39+
patched_versions:
40+
- ">= 4.17.21"
41+
related:
42+
url:
43+
- https://nvd.nist.gov/vuln/detail/CVE-2020-28500
44+
- https://github.com/lodash/lodash/pull/5065
45+
- https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7
46+
- https://github.com/lodash/lodash/blob/npm/trimEnd.js
47+
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
48+
- https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896
49+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894
50+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892
51+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895
52+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893
53+
- https://www.oracle.com//security-alerts/cpujul2021.html
54+
- https://www.oracle.com/security-alerts/cpuoct2021.html
55+
- https://www.oracle.com/security-alerts/cpujan2022.html
56+
- https://www.oracle.com/security-alerts/cpujul2022.html
57+
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
58+
- https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a
59+
- https://security.netapp.com/advisory/ntap-20210312-0006
60+
- https://github.com/advisories/GHSA-29mw-wpgm-hmr9

‎gems/lodash-rails/CVE-2020-8203.yml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
gem: lodash-rails
3+
cve: 2020-8203
4+
ghsa: p6mc-m468-83gw
5+
url: https://github.com/advisories/GHSA-p6mc-m468-83gw
6+
title: Prototype Pollution in lodash
7+
date: 2020-07-15
8+
description: |
9+
Versions of lodash prior to 4.17.19 are vulnerable to Prototype
10+
Pollution. The functions `pick`, `set`, `setWith`, `update`,
11+
`updateWith`, and `zipObjectDeep` allow a malicious user to
12+
modify the prototype of Object if the property identifiers are
13+
user-supplied. Being affected by this issue requires manipulating
14+
objects based on user-provided property values or arrays.
15+
16+
This vulnerability causes the addition or modification of an
17+
existing property that will exist on all objects and may lead to
18+
Denial of Service or Code Execution under specific circumstances.
19+
cvss_v2: 5.8
20+
cvss_v3: 7.4
21+
unaffected_versions:
22+
- "< 3.7.0"
23+
patched_versions:
24+
- ">= 4.17.19"
25+
related:
26+
url:
27+
- https://nvd.nist.gov/vuln/detail/CVE-2020-8203
28+
- https://hackerone.com/reports/712065
29+
- https://github.com/lodash/lodash/issues/4744
30+
- https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12
31+
- https://github.com/lodash/lodash/issues/4874
32+
- https://github.com/github/advisory-database/pull/2884
33+
- https://hackerone.com/reports/864701
34+
- https://github.com/lodash/lodash/wiki/Changelog#v41719
35+
- https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744
36+
- https://security.netapp.com/advisory/ntap-20200724-0006
37+
- https://github.com/advisories/GHSA-p6mc-m468-83gw

‎gems/lodash-rails/CVE-2021-23337.yml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
gem: lodash-rails
3+
cve: 2021-23337
4+
ghsa: 35jh-r3h4-6jhm
5+
url: https://github.com/advisories/GHSA-35jh-r3h4-6jhm
6+
title: Command Injection in lodash
7+
date: 2021-05-06
8+
description: |
9+
lodash versions prior to 4.17.21 are vulnerable to
10+
Command Injection via the template function.
11+
cvss_v2: 6.5
12+
cvss_v3: 7.2
13+
patched_versions:
14+
- ">= 4.17.21"
15+
related:
16+
url:
17+
- https://nvd.nist.gov/vuln/detail/CVE-2021-23337
18+
- https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
19+
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
20+
- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851
21+
- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js
22+
- https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932
23+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930
24+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928
25+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931
26+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929
27+
- https://www.oracle.com//security-alerts/cpujul2021.html
28+
- https://www.oracle.com/security-alerts/cpuoct2021.html
29+
- https://www.oracle.com/security-alerts/cpujan2022.html
30+
- https://www.oracle.com/security-alerts/cpujul2022.html
31+
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
32+
- https://security.netapp.com/advisory/ntap-20210312-0006
33+
- https://github.com/advisories/GHSA-35jh-r3h4-6jhm

0 commit comments

Comments
 (0)