Bug 2431740 (CVE-2025-13465)
| Summary: | CVE-2025-13465 lodash: prototype pollution in _.unset and _.omit functions | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aazores, abarbaro, abokovoy, abrianik, abuckta, adudiak, akostadi, alcohan, alizardo, amasferr, amctagga, anjoseph, anpicker, anthomas, aoconnor, aschwart, asoldano, bbaranow, bbrownin, bdettelb, bmaxwell, bniver, boliveir, bparees, brasmith, brian.stansberry, bsmejkal, carlmart, caswilli, chfoley, cmah, cochase, darran.lofthouse, dbosanac, dfreiber, dhanak, dhanina, dkuc, dmayorov, dnakabaa, doconnor, dosoudil, dranck, drosa, drow, dymurray, eaguilar, ebaron, ehelms, eric.wittmann, fdeutsch, flucifre, frenaud, ftrivino, ggainey, ggrzybek, gmalinko, gmeno, gotiwari, gparvin, groman, hasun, ibek, ibolton, istudens, ivassile, iweiss, jachapma, janstey, jbalunas, jburrell, jcantril, jchui, jfula, jgrulich, jhe, jhorak, jkoehler, jlledo, jmatthew, jmontleo, joehler, jolong, jowilson, jprabhak, jreimann, jrokos, jscholz, juwatts, jwong, kaycoth, kshier, ktsao, kverlaen, lball, lchilton, lcouzens, lphiri, manissin, mbenjamin, mdessi, mhackett, mhulan, mnovotny, mosmerov, mposolda, mrizzi, mskarbek, mstipich, msvehla, mvyas, mwringe, nboldt, ngough, nipatil, nmoumoul, nwallace, nyancey, omaciel, ometelka, orabin, oramraz, osousa, pahickey, pantinor, parichar, pberan, pbizzarr, pcattana, pcreech, pdelbell, pesilva, pgaikwad, pjindal, pmackay, progier, psrna, ptisnovs, rchan, rexwhite, rhaigner, rjohnson, rkubis, rmartinc, rojacob, rstancel, rstepani, sausingh, sdawley, sdoran, sfeifer, slucidi, smaestri, smallamp, smullick, snegrini, sostapov, spichugi, sseago, ssidhaye, ssilvert, stcannon, sthirugn, sthorger, stirabos, swoodman, syedriko, tasato, tbordaz, teagle, thason, tmalecek, tom.jenkinson, tpopela, tsedmik, ttakamiy, vashirov, vereddy, veshanka, vkumar, vmuzikar, wtam, xdharmai, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2432924, 2432925, 2432926, 2432932, 2432933, 2432935, 2432936, 2432942, 2432943, 2432944, 2432947, 2432948, 2432953, 2432955, 2432959, 2432964, 2432965, 2432967, 2432968, 2432969, 2432970, 2432971, 2432972, 2432973, 2432975, 2432976, 2432979, 2432982, 2432991, 2432995, 2432996, 2433000, 2433002, 2433006, 2433010, 2433012, 2433013, 2433016, 2433017, 2433018, 2433019, 2433020, 2433021, 2433022, 2433024, 2433025, 2433028, 2433032, 2433041, 2433043, 2433046, 2433047, 2432919, 2432920, 2432921, 2432922, 2432923, 2432927, 2432928, 2432929, 2432930, 2432931, 2432934, 2432937, 2432938, 2432939, 2432940, 2432941, 2432945, 2432946, 2432949, 2432950, 2432951, 2432952, 2432954, 2432956, 2432957, 2432958, 2432960, 2432961, 2432962, 2432963, 2432966, 2432974, 2432977, 2432978, 2432980, 2432981, 2432983, 2432984, 2432985, 2432986, 2432987, 2432988, 2432989, 2432990, 2432992, 2432993, 2432994, 2432997, 2432998, 2432999, 2433001, 2433003, 2433004, 2433005, 2433007, 2433008, 2433009, 2433011, 2433014, 2433015, 2433023, 2433026, 2433027, 2433029, 2433030, 2433031, 2433033, 2433034, 2433035, 2433036, 2433037, 2433038, 2433039, 2433040, 2433042, 2433044, 2433045, 2433048 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-01-21 20:01:53 UTC
This issue has been addressed in the following products: Cryostat 4 on RHEL 9 Via RHSA-2026:1845 https://access.redhat.com/errata/RHSA-2026:1845 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:2438 https://access.redhat.com/errata/RHSA-2026:2438 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:2452 https://access.redhat.com/errata/RHSA-2026:2452 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:2462 https://access.redhat.com/errata/RHSA-2026:2462 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:2465 https://access.redhat.com/errata/RHSA-2026:2465 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2026:2469 https://access.redhat.com/errata/RHSA-2026:2469 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2026:2484 https://access.redhat.com/errata/RHSA-2026:2484 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:2818 https://access.redhat.com/errata/RHSA-2026:2818 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:2816 https://access.redhat.com/errata/RHSA-2026:2816 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:2819 https://access.redhat.com/errata/RHSA-2026:2819 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:2817 https://access.redhat.com/errata/RHSA-2026:2817 This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.6 for RHEL 9 Red Hat Ansible Automation Platform 2.6 for RHEL 10 Via RHSA-2026:3958 https://access.redhat.com/errata/RHSA-2026:3958 |