REDHAT-BUG-2431740: High severity npm/lodash vulnerability
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the .unset and .omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.
The issue permits deletion of properties but does not allow overwriting their original behavior.
This issue is patched on 4.17.23
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
lodashto a version that resolves this vulnerability.Fixed in 4.17.23
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2431740?
The severity of REDHAT-BUG-2431740 is considered moderate due to the potential risks associated with prototype pollution.
How do I fix REDHAT-BUG-2431740?
To fix REDHAT-BUG-2431740, you should upgrade Lodash to a version higher than 4.17.22.
Which versions of Lodash are affected by REDHAT-BUG-2431740?
Lodash versions from 4.0.0 through 4.17.22 are affected by REDHAT-BUG-2431740.
What functions in Lodash are vulnerable in REDHAT-BUG-2431740?
The vulnerable functions in REDHAT-BUG-2431740 are _.unset and _.omit.
What type of attack is facilitated by REDHAT-BUG-2431740?
REDHAT-BUG-2431740 enables attackers to perform prototype pollution attacks by crafting specific paths.