CVE-2019-1010266
Regular Expression Denial of Service (ReDoS) in lodash
Résumé
Regular Expression Denial of Service (ReDoS) in lodash
Description d'origine
La description telle que publiée par la source (souvent en anglais).
lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.7.11.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
npm
lodash
[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"4.17.11"}]}]
npm
lodash-es
[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"4.17.11"}]}]
npm
lodash-amd
[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"4.17.11"}]}]
RubyGems
lodash-rails
[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.17.11"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2019-1010266 node-lodash Corrigé dans: 4.17.11+dfsg-1
- Ubuntu UBUNTU-CVE-2019-1010266 node-lodash
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web security.netapp.com
- web snyk.io