Prototype Pollution in lodash

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2018-16487 · ADVISORY
• lodash/lodash commit 90e6199 · WEB
• hackerone.com/reports/380873 · WEB
• rubysec/ruby-advisory-db · WEB
• security.netapp.com/advisory/ntap-20190919-0004 · WEB
• security.netapp.com/advisory/ntap-20190919-0004 · Third Party Advisory

lodash-rails のその他の脆弱性

• CVE-2021-23337高 7.2Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
• CVE-2020-28500中 5.3Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions…
• CVE-2020-8203高 7.4Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
• CVE-2019-10744緊急 9.1Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modif…
• CVE-2019-1010266中 6.5lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date…