Denial of Service in lodash
Summary
CVE-2019-1010266: lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. Affects node-lodash across 2 version ranges.
< 3e273e915d1c4176a987fa6ad65e849f59d60453
< 4.17.11+dfsg-1
Fixed in 4.17.11+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lodash package is a popular utility library for JavaScript that provides helpful functions for manipulating arrays, objects, and other data types. It is widely used in various applications and frameworks. However, versions prior to 4.17.11 of lodash are vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2019-1010266, is categorized as CWE-400: Uncontrolled Resource Consumption. The issue arises in the Date handler component of lodash. An attacker can exploit this vulnerability by providing very long strings, which the library attempts to match using a regular expression. This can lead to excessive resource consumption and result in a DoS condition. The impact of this vulnerability is limited to denial of service, and no unauthorized access or data leakage is involved.
How To Fix
Minimum fixed version
4.17.11+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-lodashTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the lodash package to the fixed version to ensure the security and stability of your application.
Conclusion
In conclusion, the lodash package prior to version 4.17.11 is vulnerable to a Denial of Service attack. It is crucial to update the package to the fixed version to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for node-lodash →
FAQ
The impact of this vulnerability is limited to denial of service. It does not involve unauthorized access or data leakage.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including this one.
No, there is no known workaround for this vulnerability. It is essential to update the lodash package to the fixed version.
No, this vulnerability only results in denial of service. It does not involve any unauthorized access or data leakage.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for node-lodash.
