kritisch
CVE-2019-10744
nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GHSA9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Red Hat9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, Ruby Advisory DB. Niedriger laut Red Hat (hoch).
Beschreibung
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| npm::GitHub Security Advisory npm | lodash, lodash-amd, lodash-es und 1 weitere | 4.17.12 und 3 weitere |
| rubygems::GitHub Security Advisory RubyGems | lodash-rails | 4.17.12 |
| rubygems::Ruby Advisory Database | lodash-rails | >= 4.17.12 |
| debian 10 | node-lodash | 4.17.11+dfsg-2+deb10u1 |
| debian 11 | node-lodash | 4.17.15+dfsg-1 |
| debian 12 | node-lodash | 4.17.15+dfsg-1 |
| debian 13 | node-lodash | 4.17.15+dfsg-1 |
| debian 14 | node-lodash | 4.17.15+dfsg-1 |
| debian 8 | node-lodash | kein Fix angegeben |
| debian 9 | node-lodash | kein Fix angegeben |
| echo | node-lodash | 4.17.15+dfsg-1 |
| Red Hat | nodejs-lodash | kein Fix angegeben |
Alle 15 Einträge aus 12 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| npm::GitHub Security Advisory npm | lodash | 4.17.12 |
| npm::GitHub Security Advisory npm | lodash-amd | 4.17.13 |
| npm::GitHub Security Advisory npm | lodash-es | 4.17.14 |
| npm::GitHub Security Advisory npm | lodash.defaultsdeep | 4.6.1 |
| rubygems::GitHub Security Advisory RubyGems | lodash-rails | 4.17.12 |
| rubygems::Ruby Advisory Database | lodash-rails | >= 4.17.12 |
| debian 10 | node-lodash | 4.17.11+dfsg-2+deb10u1 |
| debian 11 | node-lodash | 4.17.15+dfsg-1 |
| debian 12 | node-lodash | 4.17.15+dfsg-1 |
| debian 13 | node-lodash | 4.17.15+dfsg-1 |
| debian 14 | node-lodash | 4.17.15+dfsg-1 |
| debian 8 | node-lodash | kein Fix angegeben |
| debian 9 | node-lodash | kein Fix angegeben |
| echo | node-lodash | 4.17.15+dfsg-1 |
| Red Hat | nodejs-lodash | kein Fix angegeben |
Referenzen
- https://access.redhat.com/errata/RHSA-2019:3024
- https://access.redhat.com/security/cve/CVE-2019-10744
- https://github.com/advisories/GHSA-jf85-cpcp-j695
- https://github.com/lodash/lodash/pull/4336
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2019-10744.yml
- https://nvd.nist.gov/vuln/detail/CVE-2019-10744
- https://security.netapp.com/advisory/ntap-20191004-0005
- https://security.netapp.com/advisory/ntap-20191004-0005/
Alle 16 Referenzen
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://support.f5.com/csp/article/K47105354
- https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS
- https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS
- https://www.cve.org/CVERecord?id=CVE-2019-10744
- https://www.npmjs.com/advisories/1065
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html