Bug 1857412 (CVE-2020-8203) - CVE-2020-8203 nodejs-lodash: prototype pollution in zipObjectDeep function
Summary: CVE-2020-8203 nodejs-lodash: prototype pollution in zipObjectDeep function
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-8203
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1859861 1857565 1857566 1857567 1857568 1857569 1857570 1857571 1857591 1857592 1857593 1859559 1859560 1859561 1859562 1859563 1859564 1859565 1859566 1859567 1859568 1859582
Blocks: 1857413
TreeView+ depends on / blocked
 
Reported: 2020-07-15 19:45 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-10-19 12:10 UTC (History)
47 users (show)

See Also:
Fixed In Version: nodejs-lodash 4.17.16
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability.
Clone Of:
Environment:
Last Closed: 2020-08-07 01:27:46 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:3369 0 None None None 2020-08-06 20:17:59 UTC
Red Hat Product Errata RHSA-2020:3370 0 None None None 2020-08-06 20:16:26 UTC
Red Hat Product Errata RHSA-2020:3807 0 None None None 2020-09-23 16:10:57 UTC
Red Hat Product Errata RHSA-2020:4298 0 None None None 2020-10-27 16:24:43 UTC
Red Hat Product Errata RHSA-2020:5179 0 None None None 2020-11-24 13:09:10 UTC
Red Hat Product Errata RHSA-2020:5611 0 None None None 2020-12-17 09:00:31 UTC
Red Hat Product Errata RHSA-2021:3917 0 None None None 2021-10-19 12:10:20 UTC

Description Guilherme de Almeida Suckevicz 2020-07-15 19:45:32 UTC 
Prototype pollution attack when using _.zipObjectDeep in lodash <= 4.17.15.

Reference:
https://hackerone.com/reports/712065
Comment 5 Mark Cooper 2020-07-21 01:34:41 UTC 
Upstream fix: https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12
Comment 9 Przemyslaw Roguski 2020-07-22 12:09:01 UTC 
External References:

https://hackerone.com/reports/712065
https://www.npmjs.com/advisories/1523
Comment 12 Przemyslaw Roguski 2020-07-22 13:07:07 UTC 
Changing the CVSS:
AC:L -> AC:H
To exploit this vulnerability the attacker must to zip object based on user-provided property arrays, which means somehow must to guess the array properties first.
Comment 15 Stoyan Nikolov 2020-07-22 14:11:23 UTC 
Statement:

In OpenShift ServiceMesh (OSSM), Red Hat OpenShift Jaeger (RHOSJ) and Red Hat OpenShift Container Platform (RHOCP), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-lodash library to authenticated users only, therefore the impact is low.

Red Hat OpenShift Container Platform 4 delivers the kibana package where the nodejs-lodash library is used, but due to the code changing to the container first content the kibana package is marked as wontfix. This may be fixed in the future.

Red Hat Virtualization uses vulnerable version of nodejs-lodash, however zipObjectDeep is not used, therefore the impact is low.
Comment 16 Przemyslaw Roguski 2020-07-23 07:58:53 UTC 
Created nodejs-lodash tracking bugs for this issue:

Affects: epel-all [bug 1859861]
Comment 18 errata-xmlrpc 2020-08-06 20:16:22 UTC 
This issue has been addressed in the following products:

  Jaeger-1.17

Via RHSA-2020:3370 https://access.redhat.com/errata/RHSA-2020:3370
Comment 19 errata-xmlrpc 2020-08-06 20:17:55 UTC 
This issue has been addressed in the following products:

  OpenShift Service Mesh 1.1
  Openshift Service Mesh 1.1

Via RHSA-2020:3369 https://access.redhat.com/errata/RHSA-2020:3369
Comment 20 Product Security DevOps Team 2020-08-07 01:27:46 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-8203
Comment 22 errata-xmlrpc 2020-09-23 16:10:53 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization Engine 4.4

Via RHSA-2020:3807 https://access.redhat.com/errata/RHSA-2020:3807
Comment 23 errata-xmlrpc 2020-10-27 16:24:39 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2020:4298 https://access.redhat.com/errata/RHSA-2020:4298
Comment 25 errata-xmlrpc 2020-11-24 13:09:08 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization Engine 4.4

Via RHSA-2020:5179 https://access.redhat.com/errata/RHSA-2020:5179
Comment 28 errata-xmlrpc 2020-12-17 09:00:27 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2020:5611 https://access.redhat.com/errata/RHSA-2020:5611
Comment 29 errata-xmlrpc 2021-10-19 12:10:17 UTC 
This issue has been addressed in the following products:

  Red Hat Quay 3

Via RHSA-2021:3917 https://access.redhat.com/errata/RHSA-2021:3917
Note You need to log in before you can comment on or make changes to this bug.