Lucene search
Veracode Vulnerability DatabaseVERACODE:29408HistoryFeb 16, 2021 - 4:13 a.m.
Regular Expression Denial Of Service (ReDoS)
2021-02-1604:13:54
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
12
0.002 Low
EPSS
Percentile
61.5%
lodash is vulnerable to regular expression denial of service. The usage of the insecure regex /\s+$/ allows an attacker to cause exponential processing time which could eventually lead to a denial of service condition.
References
github.com/lodash/lodash/blob/npm/trimEnd.js%23L8
github.com/lodash/lodash/pull/5065
security.netapp.com/advisory/ntap-20210312-0006/
www.oracle.com//security-alerts/cpujul2021.html
www.oracle.com/security-alerts/cpujan2022.html
www.oracle.com/security-alerts/cpujul2022.html
www.oracle.com/security-alerts/cpuoct2021.html
Related
ibm
ibm
Security Bulletin: A security vulnerability in Node.js Lodash module affects IBM Cloud Automation Manager.
2023-05-15 12:07:40
Security Bulletin: IBM Cloud Transformation Advisor is affected by Node.js vulnerability
2021-06-22 16:04:43
Security Bulletin: Potential vulnerability with Node.js lodash module
2021-07-30 21:10:43
nvd
nvd
CVE-2020-28500
2021-02-15 11:15:12
redhatcve
redhatcve
CVE-2020-28500
2021-02-15 21:48:23
cve
cve
CVE-2020-28500
2021-02-15 11:15:12
osv
osv
Regular Expression Denial of Service (ReDoS) in lodash
2022-01-06 20:30:46
CVE-2020-28500
2021-02-15 11:15:12
prion
prion
Design/Logic Flaw
2021-02-15 11:15:00
huntr
huntr
Inefficient Regular Expression Complexity in liriliri/licia
2021-07-18 15:31:06
cvelist
cvelist
CVE-2020-28500 Regular Expression Denial of Service (ReDoS)
2021-02-15 00:00:00
github
github
Regular Expression Denial of Service (ReDoS) in lodash
2022-01-06 20:30:46
ubuntucve
ubuntucve
CVE-2020-28500
2021-02-15 00:00:00
debiancve
debiancve
CVE-2020-28500
2021-02-15 11:15:12
nessus
nessus
RHEL 8 : Red Hat Virtualization Host security update [ovirt-4.4.8] (Moderate) (RHSA-2021:3459)
2022-09-15 00:00:00
Lodash < 4.17.21 Multiple Vulnerabilities
2021-10-04 00:00:00
redhat
redhat
f5
f5
ics
ics
Siemens SINEC INS
2022-09-15 12:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - July 2022
2022-07-19 00:00:00
Oracle Critical Patch Update Advisory - January 2022
2022-01-18 00:00:00
Oracle Critical Patch Update Advisory - April 2023
2023-04-18 00:00:00