strider-ecosystem-client-1.2.1.tgz: 7 vulnerabilities (highest severity is: 9.1) #15
Labels
security vulnerability
Security vulnerability detected by Mend
Comments
mend-for-github-com
bot
added
the
security vulnerability
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Path to dependency file: /apps/strider/package.json
Path to vulnerable library: /apps/strider/node_modules/strider-ecosystem-client/node_modules/lodash/package.json,/apps/strider/node_modules/strider-ssh-deploy/node_modules/lodash/package.json,/apps/strider/node_modules/strider-slack/node_modules/lodash/package.json
Found in HEAD commit: ee765c82cdb8fda389b5b028a35744c8dc2be1a9
Vulnerabilities
Details
Vulnerable Library - lodash-2.4.2.tgz
A utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /apps/strider/package.json
Path to vulnerable library: /apps/strider/node_modules/strider-ecosystem-client/node_modules/lodash/package.json,/apps/strider/node_modules/strider-ssh-deploy/node_modules/lodash/package.json,/apps/strider/node_modules/strider-slack/node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: ee765c82cdb8fda389b5b028a35744c8dc2be1a9
Found in base branch: master
Vulnerability Details
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-07-26
URL: CVE-2019-10744
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-jf85-cpcp-j695
Release Date: 2019-07-26
Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0
Vulnerable Library - lodash-2.4.2.tgz
A utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /apps/strider/package.json
Path to vulnerable library: /apps/strider/node_modules/strider-ecosystem-client/node_modules/lodash/package.json,/apps/strider/node_modules/strider-ssh-deploy/node_modules/lodash/package.json,/apps/strider/node_modules/strider-slack/node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: ee765c82cdb8fda389b5b028a35744c8dc2be1a9
Found in base branch: master
Vulnerability Details
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Publish Date: 2020-07-15
URL: CVE-2020-8203
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1523
Release Date: 2020-07-15
Fix Resolution: lodash - 4.17.19
Vulnerable Library - lodash-2.4.2.tgz
A utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /apps/strider/package.json
Path to vulnerable library: /apps/strider/node_modules/strider-ecosystem-client/node_modules/lodash/package.json,/apps/strider/node_modules/strider-ssh-deploy/node_modules/lodash/package.json,/apps/strider/node_modules/strider-slack/node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: ee765c82cdb8fda389b5b028a35744c8dc2be1a9
Found in base branch: master
Vulnerability Details
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Publish Date: 2021-02-15
URL: CVE-2021-23337
CVSS 3 Score Details (7.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2021-02-15
Fix Resolution: lodash - 4.17.21
Vulnerable Library - lodash-2.4.2.tgz
A utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /apps/strider/package.json
Path to vulnerable library: /apps/strider/node_modules/strider-ecosystem-client/node_modules/lodash/package.json,/apps/strider/node_modules/strider-ssh-deploy/node_modules/lodash/package.json,/apps/strider/node_modules/strider-slack/node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: ee765c82cdb8fda389b5b028a35744c8dc2be1a9
Found in base branch: master
Vulnerability Details
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
Publish Date: 2019-07-17
URL: CVE-2019-1010266
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266
Release Date: 2020-09-30
Fix Resolution: 4.17.11
Vulnerable Library - lodash-2.4.2.tgz
A utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /apps/strider/package.json
Path to vulnerable library: /apps/strider/node_modules/strider-ecosystem-client/node_modules/lodash/package.json,/apps/strider/node_modules/strider-ssh-deploy/node_modules/lodash/package.json,/apps/strider/node_modules/strider-slack/node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: ee765c82cdb8fda389b5b028a35744c8dc2be1a9
Found in base branch: master
Vulnerability Details
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
Publish Date: 2018-06-07
URL: CVE-2018-3721
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721
Release Date: 2018-06-07
Fix Resolution: 4.17.5
Vulnerable Library - lodash-2.4.2.tgz
A utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /apps/strider/package.json
Path to vulnerable library: /apps/strider/node_modules/strider-ecosystem-client/node_modules/lodash/package.json,/apps/strider/node_modules/strider-ssh-deploy/node_modules/lodash/package.json,/apps/strider/node_modules/strider-slack/node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: ee765c82cdb8fda389b5b028a35744c8dc2be1a9
Found in base branch: master
Vulnerability Details
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
Publish Date: 2019-02-01
URL: CVE-2018-16487
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487
Release Date: 2019-02-01
Fix Resolution: 4.17.11
Vulnerable Library - lodash-2.4.2.tgz
A utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /apps/strider/package.json
Path to vulnerable library: /apps/strider/node_modules/strider-ecosystem-client/node_modules/lodash/package.json,/apps/strider/node_modules/strider-ssh-deploy/node_modules/lodash/package.json,/apps/strider/node_modules/strider-slack/node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: ee765c82cdb8fda389b5b028a35744c8dc2be1a9
Found in base branch: master
Vulnerability Details
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.
Publish Date: 2021-02-15
URL: CVE-2020-28500
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500
Release Date: 2021-02-15
Fix Resolution: lodash - 4.17.21
The text was updated successfully, but these errors were encountered: