This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-1010266 →

DEBIAN-CVE-2019-1010266

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler....

Original description

The description as published by the source.

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 node-lodash

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.11+dfsg-1"}]}]

Debian:13 node-lodash

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.11+dfsg-1"}]}]

Debian:14 node-lodash

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.11+dfsg-1"}]}]

References

advisory security-tracker.debian.org