crítica
CVE-2019-10744
nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GHSA9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Red Hat9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Ruby Advisory DB. Más baja según Red Hat (alta).
Descripción
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | lodash, lodash-amd, lodash-es y 1 más | 4.17.12 y 3 más |
| rubygems::GitHub Security Advisory RubyGems | lodash-rails | 4.17.12 |
| rubygems::Ruby Advisory Database | lodash-rails | >= 4.17.12 |
| debian 10 | node-lodash | 4.17.11+dfsg-2+deb10u1 |
| debian 11 | node-lodash | 4.17.15+dfsg-1 |
| debian 12 | node-lodash | 4.17.15+dfsg-1 |
| debian 13 | node-lodash | 4.17.15+dfsg-1 |
| debian 14 | node-lodash | 4.17.15+dfsg-1 |
| debian 8 | node-lodash | sin corrección indicada |
| debian 9 | node-lodash | sin corrección indicada |
| echo | node-lodash | 4.17.15+dfsg-1 |
| Red Hat | nodejs-lodash | sin corrección indicada |
Mostrar las 15 entradas de 12 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | lodash | 4.17.12 |
| npm::GitHub Security Advisory npm | lodash-amd | 4.17.13 |
| npm::GitHub Security Advisory npm | lodash-es | 4.17.14 |
| npm::GitHub Security Advisory npm | lodash.defaultsdeep | 4.6.1 |
| rubygems::GitHub Security Advisory RubyGems | lodash-rails | 4.17.12 |
| rubygems::Ruby Advisory Database | lodash-rails | >= 4.17.12 |
| debian 10 | node-lodash | 4.17.11+dfsg-2+deb10u1 |
| debian 11 | node-lodash | 4.17.15+dfsg-1 |
| debian 12 | node-lodash | 4.17.15+dfsg-1 |
| debian 13 | node-lodash | 4.17.15+dfsg-1 |
| debian 14 | node-lodash | 4.17.15+dfsg-1 |
| debian 8 | node-lodash | sin corrección indicada |
| debian 9 | node-lodash | sin corrección indicada |
| echo | node-lodash | 4.17.15+dfsg-1 |
| Red Hat | nodejs-lodash | sin corrección indicada |
Referencias
- https://access.redhat.com/errata/RHSA-2019:3024
- https://access.redhat.com/security/cve/CVE-2019-10744
- https://github.com/advisories/GHSA-jf85-cpcp-j695
- https://github.com/lodash/lodash/pull/4336
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2019-10744.yml
- https://nvd.nist.gov/vuln/detail/CVE-2019-10744
- https://security.netapp.com/advisory/ntap-20191004-0005
- https://security.netapp.com/advisory/ntap-20191004-0005/
Las 16 referencias
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://support.f5.com/csp/article/K47105354
- https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS
- https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS
- https://www.cve.org/CVERecord?id=CVE-2019-10744
- https://www.npmjs.com/advisories/1065
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html