CVE-2020-28500

Description

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

CVSS breakdown

Affected products

• lodash / lodash4.17.21
• oracle / banking_corporate_lending_process_management14.2.0 – 14.2.0
• oracle / banking_corporate_lending_process_management14.3.0 – 14.3.0
• oracle / banking_corporate_lending_process_management14.5.0 – 14.5.0
• oracle / banking_credit_facilities_process_management14.2.0 – 14.2.0
• oracle / banking_credit_facilities_process_management14.3.0 – 14.3.0
• oracle / banking_credit_facilities_process_management14.5.0 – 14.5.0
• oracle / banking_extensibility_workbench14.2.0 – 14.2.0
• oracle / banking_extensibility_workbench14.3.0 – 14.3.0
• oracle / banking_extensibility_workbench14.5.0 – 14.5.0
• oracle / banking_supply_chain_finance14.2.0 – 14.2.0
• oracle / banking_supply_chain_finance14.3.0 – 14.3.0
• oracle / banking_supply_chain_finance14.5.0 – 14.5.0
• oracle / banking_trade_finance_process_management14.2.0 – 14.2.0
• oracle / banking_trade_finance_process_management14.3.0 – 14.3.0
• oracle / banking_trade_finance_process_management14.5.0 – 14.5.0
• oracle / communications_cloud_native_core_policy1.11.0 – 1.11.0
• oracle / communications_design_studio7.4.2 – 7.4.2
• oracle / communications_services_gatekeeper7.0 – 7.0
• oracle / communications_session_border_controller8.4 – 8.4
• oracle / communications_session_border_controller9.0 – 9.0
• oracle / enterprise_communications_broker3.2.0 – 3.2.0
• oracle / enterprise_communications_broker3.3.0 – 3.3.0
• oracle / financial_services_crime_and_compliance_management_studio8.0.8.2.0 – 8.0.8.2.0
• oracle / financial_services_crime_and_compliance_management_studio8.0.8.3.0 – 8.0.8.3.0
• oracle / health_sciences_data_management_workbench2.5.2.1 – 2.5.2.1
• oracle / health_sciences_data_management_workbench3.0.0.0 – 3.0.0.0
• oracle / jd_edwards_enterpriseone_tools9.2.6.1
• oracle / peoplesoft_enterprise_peopletools8.58 – 8.58
• oracle / peoplesoft_enterprise_peopletools8.59 – 8.59
• oracle / primavera_gateway17.12.0 – 17.12.11
• oracle / primavera_unifier17.7 – 17.12
• oracle / primavera_unifier18.8 – 18.8
• oracle / primavera_unifier19.12 – 19.12
• oracle / primavera_unifier20.12 – 20.12
• oracle / retail_customer_management_and_segmentation_foundation19.0 – 19.0
• Siemens / SINEC INS1.0
• Siemens / SINEC INS1.0 – 1.0
• Siemens / SINEC INS1.0 – 1.0

References

• MISChttps://snyk.io/vuln/SNYK-JS-LODASH-1018905
• MISChttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892
• MISChttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893
• MISChttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894
• MISChttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895
• MISChttps://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896
• MISChttps://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8
• PATCHhttps://github.com/lodash/lodash/pull/5065
• VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
• MISChttps://security.netapp.com/advisory/ntap-20210312-0006/
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2022.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2022.html
• MISChttps://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf