CVE-2019-1010266
Regular Expression Denial of Service (ReDoS) in lodash
Summary
Regular Expression Denial of Service (ReDoS) in lodash
Original description
The description as published by the source.
lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.7.11.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
npm
lodash
[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"4.17.11"}]}]
npm
lodash-es
[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"4.17.11"}]}]
npm
lodash-amd
[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"4.17.11"}]}]
RubyGems
lodash-rails
[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.17.11"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2019-1010266 node-lodash Fixed in: 4.17.11+dfsg-1
- Ubuntu UBUNTU-CVE-2019-1010266 node-lodash
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web security.netapp.com
- web snyk.io