CVE-2019-1010266

Reference Links

• https://exchange.xforce.ibmcloud.com/vulnerabilities/168402
• https://www.ibm.com/support/pages/node/7047640 (Advisory)
• https://github.com/lodash/lodash/issues/3359
• https://github.com/lodash/lodash/wiki/Changelog
• https://security.netapp.com/advisory/ntap-20190919-0004/
• https://snyk.io/vuln/SNYK-JS-LODASH-73639
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1743097
• https://access.redhat.com/errata/RHSA-2021:3917
• https://bugzilla.redhat.com/show_bug.cgi?id=1743096

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7047640

Frequently Asked Questions

• What is CVE-2019-1010266?

  CVE-2019-1010266 is a vulnerability in Lodash that can be exploited by a local attacker to cause a denial of service.

• How does CVE-2019-1010266 work?

  CVE-2019-1010266 is caused by uncontrolled resource consumption in the Date handler of Lodash, which allows an attacker to crash the application by sending an overly long string.

• What is the severity of CVE-2019-1010266?

  CVE-2019-1010266 has a severity rating of medium (4) due to the potential denial of service impact.

• Which software is affected by CVE-2019-1010266?

  Lodash version 4.7.11 is affected by CVE-2019-1010266. IBM Security Verify Governance versions up to and including 10.0 are also affected.

• How can I fix CVE-2019-1010266?

  To fix CVE-2019-1010266, update Lodash to version 4.7.11 or higher. For IBM Security Verify Governance, update to a version higher than 10.0.