-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CVE-2018-3721 (Medium) detected in multiple libraries #40
Labels
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
Comments
mend-for-github-com
bot
added
the
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
label
Jan 25, 2022
1 task
This was referenced Feb 10, 2022
1 task
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory. |
mend-for-github-com
bot
changed the title
CVE-2018-3721 (Medium) detected in multiple libraries
CVE-2018-3721 (Medium) detected in multiple libraries - autoclosed
Apr 20, 2024
mend-for-github-com
bot
changed the title
CVE-2018-3721 (Medium) detected in multiple libraries - autoclosed
CVE-2018-3721 (Medium) detected in lodash-3.10.1.tgz
Apr 25, 2024
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory. |
mend-for-github-com
bot
changed the title
CVE-2018-3721 (Medium) detected in lodash-3.10.1.tgz
CVE-2018-3721 (Medium) detected in lodash-3.10.1.tgz, lodash-2.4.2.tgz
Apr 27, 2024
mend-for-github-com
bot
changed the title
CVE-2018-3721 (Medium) detected in lodash-3.10.1.tgz, lodash-2.4.2.tgz
CVE-2018-3721 (Medium) detected in multiple libraries
Apr 29, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
0 participants
CVE-2018-3721 - Medium Severity Vulnerability
Vulnerable Libraries - lodash-1.0.2.tgz, lodash.merge-3.3.2.tgz, lodash-3.10.1.tgz, lodash-2.4.2.tgz
lodash-1.0.2.tgz
A utility library delivering consistency, customization, performance, and extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-1.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/globule/node_modules/lodash/package.json
Dependency Hierarchy:
lodash.merge-3.3.2.tgz
The modern build of lodash’s `_.merge` as a module.
Library home page: https://registry.npmjs.org/lodash.merge/-/lodash.merge-3.3.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash.merge/package.json
Dependency Hierarchy:
lodash-3.10.1.tgz
The modern build of lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/babel-core/node_modules/lodash/package.json,/node_modules/babel/node_modules/lodash/package.json,/node_modules/babel-plugin-proto-to-assign/node_modules/lodash/package.json,/node_modules/babel-jest/node_modules/lodash/package.json,/node_modules/inquirer/node_modules/lodash/package.json
Dependency Hierarchy:
lodash-2.4.2.tgz
A utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d
Found in base branch: master
Vulnerability Details
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
Mend Note: Converted from WS-2019-0184, on 2022-11-08.
Publish Date: 2018-04-26
URL: CVE-2018-3721
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1067
Release Date: 2018-04-26
Fix Resolution (lodash): 4.17.5
Direct dependency fix Resolution (gulp): 4.0.0
Fix Resolution (lodash.merge): 4.17.5
Direct dependency fix Resolution (eslint): 2.0.0
Fix Resolution (lodash): 4.17.5
Direct dependency fix Resolution (babel-core): 6.9.0
⛑️ Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: