NVD脆弱性詳細

CVE-2020-28500

概要	Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
公表日	2021年2月15日20:15
登録日	2021年2月16日10:00
最終更新日	2024年11月21日14:22

CVSS3.1 : MEDIUM
スコア	5.3
ベクター	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	低

CVSS2.0 : MEDIUM
スコア	5.0
ベクター	AV:N/AC:L/Au:N/C:N/I:N/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	低
全ての特権を取得	いいえ
ユーザー権限を取得	いいえ
その他の権限を取得	いいえ
ユーザー操作が必要	いいえ

影響を受けるソフトウェアの構成

構成1		以上	以下	より上	未満
cpe:2.3:a:lodash:lodash::::::node.js::*					4.17.21

構成2	以上	以下	より上	未満
cpe:2.3:a:oracle:primavera_unifier:18.8:::::::*
cpe:2.3:a:oracle:primavera_unifier::::::::	17.7	17.12
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:::::::*
cpe:2.3:a:oracle:primavera_unifier:19.12:::::::*
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:::::::*
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:::::::*
cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:::::::*
cpe:2.3:a:oracle:primavera_unifier:20.12:::::::*
cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:::::::*
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:::::::*
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:::::::*
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:::::::*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:::::::*
cpe:2.3:a:oracle:primavera_gateway::::::::	17.12.0	17.12.11
cpe:2.3:a:oracle:communications_session_border_controller:8.4:::::::*
cpe:2.3:a:oracle:communications_session_border_controller:9.0:::::::*
cpe:2.3:a:oracle:primavera_gateway::::::::	20.12.0	20.12.7
cpe:2.3:a:oracle:primavera_gateway::::::::	19.12.0	19.12.11
cpe:2.3:a:oracle:primavera_gateway::::::::	18.8.0	18.8.12
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:::::::*
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:::::::*
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:::::::*
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:::::::*
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:::::::*
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:::::::*
cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:::::::*
cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:::::::*
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:::::::*
cpe:2.3:a:oracle:communications_design_studio:7.4.2:::::::*
cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:::::::*
cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:::::::*
cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:::::::*
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:::::::*
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools::::::::				9.2.6.1
cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:::::::*
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:::::::*
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:::::::*
cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:::::::*

構成3	以上	以下	より上	未満
cpe:2.3:a:siemens:sinec_ins:1.0:sp1::::::
cpe:2.3:a:siemens:sinec_ins::::::::				1.0
cpe:2.3:a:siemens:sinec_ins:1.0:-::::::

関連情報、対策とツール

No	URL	タグ
1	https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf	Patch Third Party Advisory
2	https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf	Patch Third Party Advisory
3	https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8	Broken Link
4	https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8	Broken Link
5	https://github.com/lodash/lodash/pull/5065	Patch Third Party Advisory
6	https://github.com/lodash/lodash/pull/5065	Patch Third Party Advisory
7	https://security.netapp.com/advisory/ntap-20210312-0006/	Third Party Advisory
8	https://security.netapp.com/advisory/ntap-20210312-0006/	Third Party Advisory
9	https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896	Exploit Third Party Advisory
10	https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896	Exploit Third Party Advisory
11	https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894	Exploit Third Party Advisory
12	https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894	Exploit Third Party Advisory
13	https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892	Exploit Third Party Advisory
14	https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892	Exploit Third Party Advisory
15	https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895	Exploit Third Party Advisory
16	https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895	Exploit Third Party Advisory
17	https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893	Exploit Third Party Advisory
18	https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893	Exploit Third Party Advisory
19	https://snyk.io/vuln/SNYK-JS-LODASH-1018905	Exploit Third Party Advisory
20	https://snyk.io/vuln/SNYK-JS-LODASH-1018905	Exploit Third Party Advisory
21	https://www.oracle.com//security-alerts/cpujul2021.html	Not Applicable Third Party Advisory
22	https://www.oracle.com//security-alerts/cpujul2021.html	Not Applicable Third Party Advisory
23	https://www.oracle.com/security-alerts/cpujan2022.html	Patch Third Party Advisory
24	https://www.oracle.com/security-alerts/cpujan2022.html	Patch Third Party Advisory
25	https://www.oracle.com/security-alerts/cpujul2022.html	Patch Third Party Advisory
26	https://www.oracle.com/security-alerts/cpujul2022.html	Patch Third Party Advisory
27	https://www.oracle.com/security-alerts/cpuoct2021.html	Patch Third Party Advisory
28	https://www.oracle.com/security-alerts/cpuoct2021.html	Patch Third Party Advisory

共通脆弱性一覧

JVN脆弱性情報

Lodash における脆弱性

タイトル	Lodash における脆弱性
概要	Lodash には、不特定の脆弱性が存在します。
想定される影響	サービス運用妨害 (DoS) 状態にされる可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2020年10月16日0:00
登録日	2021年4月5日16:49
最終更新日	2022年9月20日14:44

影響を受けるシステム

lodash

lodash 4.17.21 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-28500	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500
National Vulnerability Database (NVD)
2	CVE-2020-28500	https://nvd.nist.gov/vuln/detail/CVE-2020-28500

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	名前	URL
GitHub
1	perf: improve performance of toNumber, trim and trimEnd on large input strings #5065	https://github.com/lodash/lodash/pull/5065

その他

No	名前	URL
ICS-CERT ADVISORY
1	ICSA-22-258-05	https://www.cisa.gov/uscert/ics/advisories/icsa-22-258-05
JVN
2	JVNVU#99475301	http://jvn.jp/vu/JVNVU99475301/index.html
関連文書
3	SNYK-JAVA-ORGFUJIONWEBJARS-1074896 (Affecting org.fujion.webjars:lodash artifact, versions [0,])	https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896

変更履歴

No	変更内容	変更日
2	[2022年09月15日] 参考情報：JVN (JVNVU#99475301) を追加	2022年9月15日13:40
1	[2021年04月05日] 掲載	2021年4月5日16:49
3	[2022年09月20日] 参考情報：ICS-CERT ADVISORY (ICSA-22-258-05) を追加	2022年9月20日13:10

構成2	以上	以下	より上	未満
cpe:2.3:a:oracle:primavera_unifier:18.8:::::::*
cpe:2.3:a:oracle:primavera_unifier::::::::	17.7	17.12
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:::::::*
cpe:2.3:a:oracle:primavera_unifier:19.12:::::::*
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:::::::*
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:::::::*
cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:::::::*
cpe:2.3:a:oracle:primavera_unifier:20.12:::::::*
cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:::::::*
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:::::::*
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:::::::*
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:::::::*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:::::::*
cpe:2.3:a:oracle:primavera_gateway::::::::	17.12.0	17.12.11
cpe:2.3:a:oracle:communications_session_border_controller:8.4:::::::*
cpe:2.3:a:oracle:communications_session_border_controller:9.0:::::::*
cpe:2.3:a:oracle:primavera_gateway::::::::	20.12.0	20.12.7
cpe:2.3:a:oracle:primavera_gateway::::::::	19.12.0	19.12.11
cpe:2.3:a:oracle:primavera_gateway::::::::	18.8.0	18.8.12
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:::::::*
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:::::::*
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:::::::*
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:::::::*
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:::::::*
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:::::::*
cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:::::::*
cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:::::::*
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:::::::*
cpe:2.3:a:oracle:communications_design_studio:7.4.2:::::::*
cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:::::::*
cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:::::::*
cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:::::::*
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:::::::*
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools::::::::				9.2.6.1
cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:::::::*
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:::::::*
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:::::::*
cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:::::::*