PT-2019-11537 · Lodash · Lodash

Cristianstaicu · Published 2019-07-17 · Updated 2020-09-30 · CVE-2019-1010266

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: lodash versions prior to 4.17.11

Description: The issue is related to uncontrolled resource consumption, which can lead to a denial of service. It affects the date handler component. An attacker can exploit this by providing very long strings that the library attempts to match using a regular expression.

Recommendations: For versions prior to 4.17.11, update to version 4.17.11 to resolve the issue. As a temporary workaround, consider restricting the input length for the date handler component to prevent very long strings from being processed.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

AZL-45159

CVE-2019-1010266

GHSA-X5RQ-J2XG-H7QM

SNYK-JS-LODASH-73639

Affected Products

Lodash

References · 17

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2019-1010266.yml · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-LODASH-73639 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-1010266 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x5rq-j2xg-h7qm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010266 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-1010266 · Security Note
• https://ubuntu.com/security/CVE-2019-1010266 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-45159 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1010266 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-1010266 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-1010266 · Vendor Advisory
• https://github.com/lodash/lodash/issues/3359 · Note
• https://github.com/lodash/lodash/wiki/Changelog · Note
• https://github.com/lodash/lodash · Note
• https://github.com/lodash/lodash/commit/5c08f18d365b64063bfbfa686cbb97cdd6267347 · Note