Skip to content

Commit 5d79867

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@dfcf81a 
1 parent c6cc612 commit 5d79867

File tree

7 files changed

+304
-0
lines changed

7 files changed

+304
-0
lines changed

‎advisories/_posts/2018-07-26-CVE-2018-3721.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2018-3721 (lodash-rails): Prototype Pollution in lodash'
4+
comments: false
5+
categories:
6+
- lodash-rails
7+
advisory:
8+
gem: lodash-rails
9+
cve: 2018-3721
10+
ghsa: fvqr-27wr-82fm
11+
url: https://github.com/advisories/GHSA-fvqr-27wr-82fm
12+
title: Prototype Pollution in lodash
13+
date: 2018-07-26
14+
description: |
15+
Versions of `lodash` before 4.17.5 are vulnerable to
16+
prototype pollution.
17+
18+
The vulnerable functions are 'defaultsDeep', 'merge', and
19+
'mergeWith' which allow a malicious user to modify the
20+
prototype of `Object` via `__proto__` causing the addition
21+
or modification of an existing property that will exist
22+
on all objects.
23+
24+
## Recommendation
25+
26+
Update to version 4.17.5 or later."
27+
cvss_v2: 4.0
28+
cvss_v3: 6.5
29+
patched_versions:
30+
- ">= 4.17.5"
31+
related:
32+
url:
33+
- https://nvd.nist.gov/vuln/detail/CVE-2018-3721
34+
- https://hackerone.com/reports/310443
35+
- https://www.npmjs.com/advisories/577
36+
- https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a
37+
- https://security.netapp.com/advisory/ntap-20190919-0004
38+
- https://github.com/advisories/GHSA-fvqr-27wr-82fm
39+
---

‎advisories/_posts/2019-02-07-CVE-2018-16487.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2018-16487 (lodash-rails): Prototype Pollution in lodash'
4+
comments: false
5+
categories:
6+
- lodash-rails
7+
advisory:
8+
gem: lodash-rails
9+
cve: 2018-16487
10+
ghsa: 4xc9-xhrj-v574
11+
url: https://github.com/advisories/GHSA-4xc9-xhrj-v574
12+
title: Prototype Pollution in lodash
13+
date: 2019-02-07
14+
description: |
15+
Versions of `lodash` before 4.17.11 are vulnerable to
16+
prototype pollution.
17+
18+
The vulnerable functions are 'defaultsDeep', 'merge', and
19+
'mergeWith' which allow a malicious user to modify the
20+
prototype of `Object` via `{constructor: {prototype:
21+
{...}}}` causing the addition or modification of an existing
22+
property that will exist on all objects.
23+
24+
## Recommendation
25+
26+
Update to version 4.17.11 or later.
27+
cvss_v2: 6.8
28+
cvss_v3: 5.6
29+
patched_versions:
30+
- ">= 4.17.11"
31+
related:
32+
url:
33+
- https://nvd.nist.gov/vuln/detail/CVE-2018-16487
34+
- https://hackerone.com/reports/380873
35+
- https://www.npmjs.com/advisories/782
36+
- https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad
37+
- https://security.netapp.com/advisory/ntap-20190919-0004
38+
- https://github.com/advisories/GHSA-4xc9-xhrj-v574
39+
---

‎advisories/_posts/2019-07-10-CVE-2019-10744.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2019-10744 (lodash-rails): Prototype Pollution in lodash'
4+
comments: false
5+
categories:
6+
- lodash-rails
7+
advisory:
8+
gem: lodash-rails
9+
cve: 2019-10744
10+
ghsa: jf85-cpcp-j695
11+
url: https://github.com/advisories/GHSA-jf85-cpcp-j695
12+
title: Prototype Pollution in lodash
13+
date: 2019-07-10
14+
description: |
15+
Versions of `lodash` before 4.17.12 are vulnerable to Prototype
16+
Pollution. The function `defaultsDeep` allows a malicious user
17+
to modify the prototype of `Object` via
18+
`{constructor: {prototype: {...}}}` causing the addition or
19+
modification of an existing property that will exist on all objects.
20+
21+
## Recommendation
22+
23+
Update to version 4.17.12 or later.
24+
cvss_v2: 6.4
25+
cvss_v3: 9.1
26+
patched_versions:
27+
- ">= 4.17.12"
28+
related:
29+
url:
30+
- https://nvd.nist.gov/vuln/detail/CVE-2019-10744
31+
- https://github.com/lodash/lodash/pull/4336
32+
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
33+
- https://www.npmjs.com/advisories/1065
34+
- https://access.redhat.com/errata/RHSA-2019:3024
35+
- https://support.f5.com/csp/article/K47105354
36+
- https://www.oracle.com/security-alerts/cpujan2021.html
37+
- https://www.oracle.com/security-alerts/cpuoct2020.html
38+
- https://security.netapp.com/advisory/ntap-20191004-0005
39+
- https://github.com/advisories/GHSA-jf85-cpcp-j695
40+
---

‎advisories/_posts/2019-07-19-CVE-2019-1010266.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2019-1010266 (lodash-rails): Regular Expression Denial of Service (ReDoS)
4+
in lodash'
5+
comments: false
6+
categories:
7+
- lodash-rails
8+
advisory:
9+
gem: lodash-rails
10+
cve: 2019-1010266
11+
ghsa: x5rq-j2xg-h7qm
12+
url: https://github.com/advisories/GHSA-x5rq-j2xg-h7qm
13+
title: Regular Expression Denial of Service (ReDoS) in lodash
14+
date: 2019-07-19
15+
description: |
16+
lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled
17+
Resource Consumption. The impact is: Denial of service. The
18+
component is: Date handler. The attack vector is: Attacker
19+
provides very long strings, which the library attempts
20+
to match using a regular expression.
21+
22+
The fixed version is: 4.7.11.
23+
patched_versions:
24+
- ">= 4.17.11"
25+
related:
26+
url:
27+
- https://nvd.nist.gov/vuln/detail/CVE-2019-1010266
28+
- https://github.com/lodash/lodash/issues/3359
29+
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
30+
- https://github.com/lodash/lodash/commit/5c08f18d365b64063bfbfa686cbb97cdd6267347
31+
- https://github.com/lodash/lodash/wiki/Changelog
32+
- https://security.netapp.com/advisory/ntap-20190919-0004
33+
- https://github.com/advisories/GHSA-x5rq-j2xg-h7qm
34+
---

‎advisories/_posts/2020-07-15-CVE-2020-8203.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2020-8203 (lodash-rails): Prototype Pollution in lodash'
4+
comments: false
5+
categories:
6+
- lodash-rails
7+
advisory:
8+
gem: lodash-rails
9+
cve: 2020-8203
10+
ghsa: p6mc-m468-83gw
11+
url: https://github.com/advisories/GHSA-p6mc-m468-83gw
12+
title: Prototype Pollution in lodash
13+
date: 2020-07-15
14+
description: |
15+
Versions of lodash prior to 4.17.19 are vulnerable to Prototype
16+
Pollution. The functions `pick`, `set`, `setWith`, `update`,
17+
`updateWith`, and `zipObjectDeep` allow a malicious user to
18+
modify the prototype of Object if the property identifiers are
19+
user-supplied. Being affected by this issue requires manipulating
20+
objects based on user-provided property values or arrays.
21+
22+
This vulnerability causes the addition or modification of an
23+
existing property that will exist on all objects and may lead to
24+
Denial of Service or Code Execution under specific circumstances.
25+
cvss_v2: 5.8
26+
cvss_v3: 7.4
27+
unaffected_versions:
28+
- "< 3.7.0"
29+
patched_versions:
30+
- ">= 4.17.19"
31+
related:
32+
url:
33+
- https://nvd.nist.gov/vuln/detail/CVE-2020-8203
34+
- https://hackerone.com/reports/712065
35+
- https://github.com/lodash/lodash/issues/4744
36+
- https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12
37+
- https://github.com/lodash/lodash/issues/4874
38+
- https://github.com/github/advisory-database/pull/2884
39+
- https://hackerone.com/reports/864701
40+
- https://github.com/lodash/lodash/wiki/Changelog#v41719
41+
- https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744
42+
- https://security.netapp.com/advisory/ntap-20200724-0006
43+
- https://github.com/advisories/GHSA-p6mc-m468-83gw
44+
---

‎advisories/_posts/2021-05-06-CVE-2021-23337.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2021-23337 (lodash-rails): Command Injection in lodash'
4+
comments: false
5+
categories:
6+
- lodash-rails
7+
advisory:
8+
gem: lodash-rails
9+
cve: 2021-23337
10+
ghsa: 35jh-r3h4-6jhm
11+
url: https://github.com/advisories/GHSA-35jh-r3h4-6jhm
12+
title: Command Injection in lodash
13+
date: 2021-05-06
14+
description: |
15+
lodash versions prior to 4.17.21 are vulnerable to
16+
Command Injection via the template function.
17+
cvss_v2: 6.5
18+
cvss_v3: 7.2
19+
patched_versions:
20+
- ">= 4.17.21"
21+
related:
22+
url:
23+
- https://nvd.nist.gov/vuln/detail/CVE-2021-23337
24+
- https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
25+
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
26+
- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851
27+
- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js
28+
- https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932
29+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930
30+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928
31+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931
32+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929
33+
- https://www.oracle.com//security-alerts/cpujul2021.html
34+
- https://www.oracle.com/security-alerts/cpuoct2021.html
35+
- https://www.oracle.com/security-alerts/cpujan2022.html
36+
- https://www.oracle.com/security-alerts/cpujul2022.html
37+
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
38+
- https://security.netapp.com/advisory/ntap-20210312-0006
39+
- https://github.com/advisories/GHSA-35jh-r3h4-6jhm
40+
---

‎advisories/_posts/2022-01-06-CVE-2020-28500.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2020-28500 (lodash-rails): Regular Expression Denial of Service (ReDoS)
4+
in lodash'
5+
comments: false
6+
categories:
7+
- lodash-rails
8+
advisory:
9+
gem: lodash-rails
10+
cve: 2020-28500
11+
ghsa: 29mw-wpgm-hmr9
12+
url: https://github.com/advisories/GHSA-29mw-wpgm-hmr9
13+
title: Regular Expression Denial of Service (ReDoS) in lodash
14+
date: 2022-01-06
15+
description: |
16+
All versions of package lodash prior to 4.17.21 are vulnerable
17+
to Regular Expression Denial of Service (ReDoS) via the
18+
`toNumber`, `trim` and `trimEnd` functions.
19+
20+
Steps to reproduce (provided by reporter Liyuan Chen):
21+
22+
```
23+
var lo = require('lodash');
24+
25+
function build_blank(n) {
26+
var ret = "1"
27+
for (var i = 0; i < n; i++) {
28+
ret += " "
29+
}
30+
return ret + "1";
31+
}
32+
var s = build_blank(50000) var time0 = Date.now();
33+
lo.trim(s)
34+
var time_cost0 = Date.now() - time0;
35+
console.log("time_cost0: " + time_cost0);
36+
var time1 = Date.now();
37+
lo.toNumber(s) var time_cost1 = Date.now() - time1;
38+
console.log("time_cost1: " + time_cost1);
39+
var time2 = Date.now();
40+
lo.trimEnd(s);
41+
var time_cost2 = Date.now() - time2;
42+
console.log("time_cost2: " + time_cost2);
43+
```
44+
cvss_v2: 5.0
45+
cvss_v3: 5.3
46+
patched_versions:
47+
- ">= 4.17.21"
48+
related:
49+
url:
50+
- https://nvd.nist.gov/vuln/detail/CVE-2020-28500
51+
- https://github.com/lodash/lodash/pull/5065
52+
- https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7
53+
- https://github.com/lodash/lodash/blob/npm/trimEnd.js
54+
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
55+
- https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896
56+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894
57+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892
58+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895
59+
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893
60+
- https://www.oracle.com//security-alerts/cpujul2021.html
61+
- https://www.oracle.com/security-alerts/cpuoct2021.html
62+
- https://www.oracle.com/security-alerts/cpujan2022.html
63+
- https://www.oracle.com/security-alerts/cpujul2022.html
64+
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
65+
- https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a
66+
- https://security.netapp.com/advisory/ntap-20210312-0006
67+
- https://github.com/advisories/GHSA-29mw-wpgm-hmr9
68+
---

0 commit comments

Comments
 (0)