Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(security): force lodash > 4.17.20 - CVE-2020-8203 #1918

Closed
petermetz opened this issue Mar 14, 2022 · 0 comments · Fixed by #1919
Closed

fix(security): force lodash > 4.17.20 - CVE-2020-8203 #1918

petermetz opened this issue Mar 14, 2022 · 0 comments · Fixed by #1919
Assignees
@petermetz
Labels
dependencies Pull requests that update a dependency file P1 Priority 1: Highest Security Related to existing or potential security vulnerabilities

Comments

@petermetz
Copy link
Member

Severity
High
7.4
/ 10
CVSS base metrics
Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-770
CWE-1321
CVE ID
CVE-2020-8203
GHSA ID
GHSA-p6mc-m468-83gw

No security update is needed as lodash is no longer vulnerable
Dependabot hasn't attempted to update lodash as it's no longer vulnerable.

Package
Affected versions
Patched version
lodash
(npm)
< 4.17.20
4.17.20
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The function zipObjectDeep allows a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires zipping objects based on user-provided property arrays.

This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.
@petermetz petermetz added dependencies Pull requests that update a dependency file P1 Priority 1: Highest Security Related to existing or potential security vulnerabilities labels Mar 14, 2022
@petermetz petermetz self-assigned this Mar 14, 2022
petermetz added a commit to petermetz/cacti that referenced this issue Mar 14, 2022
@petermetz
fix(security): force lodash > 4.17.20 - CVE-2020-8203
8a61533 
TODO: Longer term we should take care to upgrade the top level
dependencies instead (as patched releases become available)

Fixes hyperledger#1918

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
@petermetz petermetz mentioned this issue Mar 14, 2022
Merged
petermetz added a commit to petermetz/cacti that referenced this issue Mar 15, 2022
@petermetz
fix(security): force lodash > 4.17.20 - CVE-2020-8203
1cfc77a 
TODO: Longer term we should take care to upgrade the top level
dependencies instead (as patched releases become available)

Fixes hyperledger#1918

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit to petermetz/cacti that referenced this issue Mar 15, 2022
@petermetz
fix(security): force lodash > 4.17.20 - CVE-2020-8203
00cb626 
TODO: Longer term we should take care to upgrade the top level
dependencies instead (as patched releases become available)

Fixes hyperledger#1918

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit to petermetz/cacti that referenced this issue Mar 15, 2022
@petermetz
fix(security): force lodash > 4.17.20 - CVE-2020-8203
35496e1 
TODO: Longer term we should take care to upgrade the top level
dependencies instead (as patched releases become available)

Fixes hyperledger#1918

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit to petermetz/cacti that referenced this issue Mar 15, 2022
@petermetz
fix(security): force lodash > 4.17.20 - CVE-2020-8203
dbb171a 
TODO: Longer term we should take care to upgrade the top level
dependencies instead (as patched releases become available)

Fixes hyperledger#1918

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
petermetz added a commit that referenced this issue Mar 15, 2022
@petermetz
fix(security): force lodash > 4.17.20 - CVE-2020-8203
08ace66 
TODO: Longer term we should take care to upgrade the top level
dependencies instead (as patched releases become available)

Fixes #1918

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@petermetz petermetz

Labels
dependencies Pull requests that update a dependency file P1 Priority 1: Highest Security Related to existing or potential security vulnerabilities
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(security): force lodash > 4.17.20 - CVE-2020-8203 petermetz/cacti
1 participant
@petermetz