Regular Expression Denial of Service (ReDoS) in lodash

2019-07-1916:13:07

CWE-400

GitHub Advisory Database

github.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.004

Percentile

73.8%

JSON

lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.7.11.

Affected configurations

Vulners

Node

lodash-amdRange<4.17.11

lodash-esRange<4.17.11

lodashlodashRange<4.17.11

VendorProductVersionCPE
*lodash-amd*cpe:2.3:a:*:lodash-amd:*:*:*:*:*:*:*:*
*lodash-es*cpe:2.3:a:*:lodash-es:*:*:*:*:*:*:*:*
lodashlodash*cpe:2.3:a:lodash:lodash:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	lodash-amd	*	cpe:2.3:a::lodash-amd::::::::*
*	lodash-es	*	cpe:2.3:a::lodash-es::::::::*
lodash	lodash	*	cpe:2.3:a:lodash:lodash::::::::