Regular Expression Denial of Service (ReDoS) in lodash

中 6.5CVE-2019-1010266 · GHSA-x5rq-j2xg-h7qm · SNYK-JS-LODASH-73639 · 17/07/2019 公開 · 17/06/2026 更新

要点

CVE-2019-1010266 は lodash-rails, lodash (lodash), lodash に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：3.0%（全脆弱性の 87.5% より高い）。
対処：4.17.11 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
lodash-rails RubyGems	`≥ 4.7.0, < 4.17.11`	`4.17.11`
lodash lodash	`< 4.17.11`	`4.17.11`
lodash npm	`≥ 4.7.0, < 4.17.11`	`4.17.11`
lodash-amd npm	`≥ 4.7.0, < 4.17.11`	`4.17.11`
lodash-es npm	`≥ 4.7.0, < 4.17.11`	`4.17.11`

概要

lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.7.11.

NVD の説明

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.