Node.js package-lock.json : library: lodash v4.17.19, HIGH severity vulnerability id: NSWG-ECO-516 , title : Allocation of Resources Without Limits or Throttling

[rickymcgeehan]

Description

Trivy is reporting a HIGH severity vulnerability in the Lodash library v4.17.19 (NSWG-ECO-516: Allocation of Resources Without Limits or Throttling). From what I gather, the problem stemmed from the zipObjectDeep function within Lodash and has now been fixed in v4.17.19. However, Trivy is still reporting it as a HIGH severity vulnerability.

Lodash PR: lodash/lodash#4759
Npm advisory: https://www.npmjs.com/advisories/1523

Please could you let me know if vulnerability is fixed and if so when the Trivy db will be updated?

What did you expect to happen?
Vulnerability NSWG-ECO-516 to not be flagged for Lodash v4.17.19.

What happened instead?
Vulnerability NSWG-ECO-516 is flagged as HIGH severity for Lodash v4.17.19.

Output of run with -debug:

2020-08-04T15:39:34.772+0100	INFO	Need to update DB
2020-08-04T15:39:34.772+0100	INFO	Downloading DB...
17.72 MiB / 17.72 MiB [------------------------------------------------------------------------------------------] 100.00% 3.13 MiB p/s 6s
2020-08-04T15:39:41.571+0100	WARN	OS is not detected and vulnerabilities in OS packages are not detected.
2020-08-04T15:39:41.571+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.576+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.584+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.591+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.592+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.592+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.592+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.593+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.593+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.594+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.601+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.601+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.602+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.603+0100	INFO	Detecting npm vulnerabilities...
2020-08-04T15:39:41.603+0100	INFO	Detecting npm vulnerabilities...

client/host/package-lock.json
=============================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)


client/package-lock.json
========================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

+---------+------------------+----------+-------------------+---------------+--------------------------------+
| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |             TITLE              |
+---------+------------------+----------+-------------------+---------------+--------------------------------+
| lodash  | NSWG-ECO-516     | HIGH     | 4.17.19           |               | Allocation of Resources        |
|         |                  |          |                   |               | Without Limits or Throttling   |
+---------+------------------+----------+-------------------+---------------+--------------------------------+

Output of trivy -v:

Version: 0.9.2
Vulnerability DB:
  Type: Light
  Version: 1
  UpdatedAt: 2020-08-04 12:13:02.259294926 +0000 UTC
  NextUpdate: 2020-08-05 00:13:02.259294526 +0000 UTC

Additional details (base image name, container registry info...):

[knqyf263]

Trivy DB depends on nodejs/security-wg as for nodejs, but it looks like the vulnerability information hasn't been updated yet. Would you send PR or raise the issue in this repository?
https://github.com/nodejs/security-wg/blob/master/vuln/npm/516.json#L16

[knqyf263]

It seems to be fixed