CVE-2019-1010266: lodash regular expression denial of service in date handler

CVE-2019-1010266 · Severity: low · CVSS 3.1 · Published 2019-07-19

lodash is a popular JavaScript utility library used across countless web applications and services. A flaw in the date parsing component allows an attacker to provide specially crafted long strings that cause excessive CPU consumption, potentially making the application unresponsive or unavailable to legitimate users.

Technologies: Lodash-Amd, lodash (npm), lodash-es (npm), lodash-rails (RubyGems). Vendors: Lodash, npm, RubyGems.

Quick answers

Is CVE-2019-1010266 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2019-1010266 being exploited in the wild.
How severe is CVE-2019-1010266?
Low severity, with a CVSS score of 3.1, published 19 July 2019.
Which products and versions are affected?
Lodash-Amd prior to 4.17.11; lodash (npm) SEMVER:introduced=4.7.0,fixed=4.17.11; lodash-es (npm) SEMVER:introduced=4.7.0,fixed=4.17.11; lodash-rails (RubyGems) ECOSYSTEM:introduced=4.7.0,fixed=4.17.11.
Is there a fix for CVE-2019-1010266?
Yes. lodash (npm): upgrade to 4.17.11 or later; lodash-es (npm): upgrade to 4.17.11 or later; lodash-rails (RubyGems): upgrade to 4.17.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-1010266 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2019-1010266?
Check whether you run Lodash-Amd, lodash (npm), lodash-es (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lodash (npm): upgrade to 4.17.11 or later
    npm install lodash@4.17.11
  • lodash-es (npm): upgrade to 4.17.11 or later
    npm install lodash-es@4.17.11
  • lodash-rails (RubyGems): upgrade to 4.17.11 or later
    bundle update lodash-rails

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) vulnerability in the date handler component of lodash prior to version 4.17.11. The vulnerable code uses a regular expression that exhibits catastrophic backtracking when matching very long input strings, allowing an attacker to trigger uncontrolled resource consumption and cause a denial of service. The attack requires network access to submit long strings to the application, with no authentication or special privileges required. The attack vector is network-based, and exploitation causes the application to hang or crash. The fix is available in lodash version 4.17.11 and later.

Affected products

  • lodash lodash prior to 4.17.11
  • lodash lodash-es prior to 4.17.11
  • lodash lodash-amd prior to 4.17.11
  • lodash lodash-rails prior to 4.17.11

Identifiers

  • CVE-2019-1010266
  • GHSA-x5rq-j2xg-h7qm

Timeline

  • 2019-07-19: disclosed
  • 2019-07-19: patched: Fixed in version 4.17.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.