Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

grunt-0.4.5.tgz: 14 vulnerabilities (highest severity is: 9.1) #863

Open
mend-bolt-for-github bot opened this issue Feb 29, 2024 · 0 comments
Open

Comments

@mend-bolt-for-github
Copy link
Contributor

Vulnerable Library - grunt-0.4.5.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-0.4.5.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/grunt/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (grunt version) Remediation Possible**
CVE-2019-10744 Critical 9.1 detected in multiple dependencies Transitive 1.0.3
WS-2019-0063 High 8.1 js-yaml-2.0.5.tgz Transitive 1.0.4
WS-2019-0032 High 7.5 js-yaml-2.0.5.tgz Transitive 1.0.4
CVE-2022-3517 High 7.5 detected in multiple dependencies Transitive N/A*
CVE-2016-10540 High 7.5 detected in multiple dependencies Transitive 1.0.0
CVE-2020-8203 High 7.4 detected in multiple dependencies Transitive 1.0.3
CVE-2021-23337 High 7.2 detected in multiple dependencies Transitive 1.0.3
CVE-2020-7729 High 7.1 grunt-0.4.5.tgz Direct 1.3.0
CVE-2022-1537 High 7.0 grunt-0.4.5.tgz Direct 1.5.3
CVE-2019-1010266 Medium 6.5 detected in multiple dependencies Transitive 1.0.3
CVE-2018-16487 Medium 5.6 detected in multiple dependencies Transitive 1.0.3
CVE-2022-0436 Medium 5.5 grunt-0.4.5.tgz Direct 1.5.1
CVE-2020-28500 Medium 5.3 detected in multiple dependencies Transitive 1.0.3
CVE-2018-3721 Medium 4.3 detected in multiple dependencies Transitive 1.0.3

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-10744

Vulnerable Libraries - lodash-2.4.2.tgz, lodash-0.9.2.tgz

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/findup-sync/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • grunt-legacy-log-0.1.3.tgz
      • lodash-2.4.2.tgz (Vulnerable Library)

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • lodash-0.9.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (grunt): 1.0.3

Step up your Open Source Security Game with Mend here

WS-2019-0063

Vulnerable Library - js-yaml-2.0.5.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-2.0.5.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • js-yaml-2.0.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Publish Date: 2019-04-05

URL: WS-2019-0063

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/813

Release Date: 2019-04-05

Fix Resolution (js-yaml): 3.13.1

Direct dependency fix Resolution (grunt): 1.0.4

Step up your Open Source Security Game with Mend here

WS-2019-0032

Vulnerable Library - js-yaml-2.0.5.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-2.0.5.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • js-yaml-2.0.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-20

URL: WS-2019-0032

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-20

Fix Resolution (js-yaml): 3.13.0

Direct dependency fix Resolution (grunt): 1.0.4

Step up your Open Source Security Game with Mend here

CVE-2022-3517

Vulnerable Libraries - minimatch-0.3.0.tgz, minimatch-0.2.14.tgz

minimatch-0.3.0.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.3.0.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/findup-sync/node_modules/minimatch/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • findup-sync-0.1.3.tgz
      • glob-3.2.11.tgz
        • minimatch-0.3.0.tgz (Vulnerable Library)

minimatch-0.2.14.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.2.14.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/minimatch/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • minimatch-0.2.14.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5

Step up your Open Source Security Game with Mend here

CVE-2016-10540

Vulnerable Libraries - minimatch-0.3.0.tgz, minimatch-0.2.14.tgz

minimatch-0.3.0.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.3.0.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/findup-sync/node_modules/minimatch/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • findup-sync-0.1.3.tgz
      • glob-3.2.11.tgz
        • minimatch-0.3.0.tgz (Vulnerable Library)

minimatch-0.2.14.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.2.14.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/minimatch/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • minimatch-0.2.14.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter.

Publish Date: 2018-05-31

URL: CVE-2016-10540

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-10540

Release Date: 2018-04-26

Fix Resolution (minimatch): 3.0.2

Direct dependency fix Resolution (grunt): 1.0.0

Fix Resolution (minimatch): 3.0.2

Direct dependency fix Resolution (grunt): 1.0.0

Step up your Open Source Security Game with Mend here

CVE-2020-8203

Vulnerable Libraries - lodash-2.4.2.tgz, lodash-0.9.2.tgz

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/findup-sync/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • grunt-legacy-log-0.1.3.tgz
      • lodash-2.4.2.tgz (Vulnerable Library)

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • lodash-0.9.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (grunt): 1.0.3

Step up your Open Source Security Game with Mend here

CVE-2021-23337

Vulnerable Libraries - lodash-2.4.2.tgz, lodash-0.9.2.tgz

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/findup-sync/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • grunt-legacy-log-0.1.3.tgz
      • lodash-2.4.2.tgz (Vulnerable Library)

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • lodash-0.9.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (grunt): 1.0.3

Step up your Open Source Security Game with Mend here

CVE-2020-7729

Vulnerable Library - grunt-0.4.5.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-0.4.5.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/grunt/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

Publish Date: 2020-09-03

URL: CVE-2020-7729

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1684

Release Date: 2020-09-03

Fix Resolution: 1.3.0

Step up your Open Source Security Game with Mend here

CVE-2022-1537

Vulnerable Library - grunt-0.4.5.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-0.4.5.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/grunt/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.

Publish Date: 2022-05-10

URL: CVE-2022-1537

CVSS 3 Score Details (7.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/0179c3e5-bc02-4fc9-8491-a1a319b51b4d/

Release Date: 2022-05-10

Fix Resolution: 1.5.3

Step up your Open Source Security Game with Mend here

CVE-2019-1010266

Vulnerable Libraries - lodash-2.4.2.tgz, lodash-0.9.2.tgz

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/findup-sync/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • grunt-legacy-log-0.1.3.tgz
      • lodash-2.4.2.tgz (Vulnerable Library)

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • lodash-0.9.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-07-17

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (grunt): 1.0.3

Step up your Open Source Security Game with Mend here

CVE-2018-16487

Vulnerable Libraries - lodash-2.4.2.tgz, lodash-0.9.2.tgz

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/findup-sync/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • grunt-legacy-log-0.1.3.tgz
      • lodash-2.4.2.tgz (Vulnerable Library)

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • lodash-0.9.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/380873

Release Date: 2019-02-01

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (grunt): 1.0.3

Step up your Open Source Security Game with Mend here

CVE-2022-0436

Vulnerable Library - grunt-0.4.5.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-0.4.5.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/grunt/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.

Publish Date: 2022-04-12

URL: CVE-2022-0436

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0436

Release Date: 2022-04-12

Fix Resolution: 1.5.1

Step up your Open Source Security Game with Mend here

CVE-2020-28500

Vulnerable Libraries - lodash-2.4.2.tgz, lodash-0.9.2.tgz

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/findup-sync/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • grunt-legacy-log-0.1.3.tgz
      • lodash-2.4.2.tgz (Vulnerable Library)

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • lodash-0.9.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (grunt): 1.0.3

Step up your Open Source Security Game with Mend here

CVE-2018-3721

Vulnerable Libraries - lodash-2.4.2.tgz, lodash-0.9.2.tgz

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/findup-sync/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • grunt-legacy-log-0.1.3.tgz
      • lodash-2.4.2.tgz (Vulnerable Library)

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /clumsy-bird/package.json

Path to vulnerable library: /clumsy-bird/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-0.4.5.tgz (Root Library)
    • lodash-0.9.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
Mend Note: Converted from WS-2019-0184, on 2022-11-08.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (4.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1067

Release Date: 2018-06-07

Fix Resolution (lodash): 4.17.5

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.5

Direct dependency fix Resolution (grunt): 1.0.3

Step up your Open Source Security Game with Mend here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

0 participants