CVE-2020-28500
published 2021-02-15CVE-2020-28500: Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
PriorityP335medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
7.34%
94.4th percentile
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Affected
46 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-lodash | < node-lodash 4.17.21+dfsg+~cs8.31.173-1 (bookworm) | node-lodash 4.17.21+dfsg+~cs8.31.173-1 (bookworm) |
| lodash | lodash | < 4.17.21 | 4.17.21 |
| lodash | lodash | — | — |
| lodash | lodash | >= 4.0.0 < 4.17.21 | 4.17.21 |
| oracle | banking_corporate_lending_process_management | — | — |
| oracle | banking_corporate_lending_process_management | — | — |
| oracle | banking_corporate_lending_process_management | — | — |
| oracle | banking_credit_facilities_process_management | — | — |
| oracle | banking_credit_facilities_process_management | — | — |
| oracle | banking_credit_facilities_process_management | — | — |
| oracle | banking_extensibility_workbench | — | — |
| oracle | banking_extensibility_workbench | — | — |
| oracle | banking_extensibility_workbench | — | — |
| oracle | banking_supply_chain_finance | — | — |
| oracle | banking_supply_chain_finance | — | — |
| oracle | banking_supply_chain_finance | — | — |
| oracle | banking_trade_finance_process_management | — | — |
| oracle | banking_trade_finance_process_management | — | — |
| oracle | banking_trade_finance_process_management | — | — |
| oracle | communications_cloud_native_core_policy | — | — |
| oracle | communications_design_studio | — | — |
| oracle | communications_services_gatekeeper | — | — |
| oracle | communications_session_border_controller | — | — |
| oracle | communications_session_border_controller | — | — |
| oracle | enterprise_communications_broker | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Regular Expression Denial of Service (ReDoS) in lodash
osv·2022-01-06
CVE-2020-28500 [MEDIUM] Regular Expression Denial of Service (ReDoS) in lodash
Regular Expression Denial of Service (ReDoS) in lodash
All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions.
Steps to reproduce (provided by reporter Liyuan Chen):
```js
var lo = require('lodash');
function build_blank(n) {
var ret = "1"
for (var i = 0; i < n; i++) {
ret += " "
}
return ret + "1";
}
var s = build_blank(50000) var time0 = Date.now();
lo.trim(s)
var time_cost0 = Date.now() - time0;
console.log("time_cost0: " + time_cost0);
var time1 = Date.now();
lo.toNumber(s) var time_cost1 = Date.now() - time1;
console.log("time_cost1: " + time_cost1);
var time2 = Date.now();
lo.trimEnd(s);
var time_cost2 = Date.now() - time2;
console.log("time_cost2: " + time_cost2);
```
GHSA
Regular Expression Denial of Service (ReDoS) in lodash
ghsa·2022-01-06
CVE-2020-28500 [MEDIUM] CWE-1333 Regular Expression Denial of Service (ReDoS) in lodash
Regular Expression Denial of Service (ReDoS) in lodash
All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions.
Steps to reproduce (provided by reporter Liyuan Chen):
```js
var lo = require('lodash');
function build_blank(n) {
var ret = "1"
for (var i = 0; i < n; i++) {
ret += " "
}
return ret + "1";
}
var s = build_blank(50000) var time0 = Date.now();
lo.trim(s)
var time_cost0 = Date.now() - time0;
console.log("time_cost0: " + time_cost0);
var time1 = Date.now();
lo.toNumber(s) var time_cost1 = Date.now() - time1;
console.log("time_cost1: " + time_cost1);
var time2 = Date.now();
lo.trimEnd(s);
var time_cost2 = Date.now() - time2;
console.log("time_cost2: " + time_cost2);
```
OSV
CVE-2020-28500: Lodash versions prior to 4
osv·2021-02-15·CVSS 5.3
CVE-2020-28500 [MEDIUM] CVE-2020-28500: Lodash versions prior to 4
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Ubuntu
Lodash vulnerabilities
vendor_ubuntu·2026-06-09·CVSS 5.3
CVE-2025-13465 [MEDIUM] Lodash vulnerabilities
Title: Lodash vulnerabilities
Summary: Several security issues were fixed in Lodash.
It was discovered that Lodash was vulnerable to a prototype pollution
issue in the zipObjectDeep function. An attacker could possibly use this
issue to modify application behavior. This issue only affected Ubuntu
18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-8203)
Liyuan Chen discovered that Lodash was vulnerable to a regular
expression denial of service issue in the toNumber, trim, and trimEnd
functions. An attacker could possibly use this issue to consume
excessive system resources, resulting in a denial of service. This issue
only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-28500)
Marc Hassan discovered that Lodash did not properly sanitize input to
the template function. An attacker could
CISA ICS
Siemens SINEC INS
cisa_ics·2022-09-15·CVSS 7.8
[HIGH] Siemens SINEC INS
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SINEC INS
Last RevisedSeptember 15, 2022
Alert CodeICSA-22-258-05
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.8
- ATTENTION: Exploitable remotely/Low attack complexity
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerabilities: Improper Input Validation, Integer Overflow or Wraparound, Uncontrolled Resource Consumption, Command Injection, Inadequate Encryption Strength, Missing Encryption of Sensitive Data, Improper Restriction of Operations Within the Bounds of a Memory Buffer, Exposure of Private Personal Information to an Unauthorized Actor, Open Redirect, Improper Resour
Red Hat
nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions
vendor_redhat·2021-02-15·CVSS 5.3
CVE-2020-28500 [MEDIUM] CWE-400 nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions
nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
A flaw was found in nodejs-lodash. A Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions is possible.
Statement: In OpenShift ServiceMesh (OSSM) and Red Hat OpenShift Jaeger (RHOSJ) the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-lodash library to authenticated users only, therefore the impact is low.
While Red Hat Virtualization's cockpit-ovirt has a dependency on lodash it doesn't use the vulnerable toNumber, trim, or trimEnd functions.
While Red Hat Quay has a dependency on lod
Debian
CVE-2020-28500: node-lodash - Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of ...
vendor_debian·2020·CVSS 5.3
CVE-2020-28500 [MEDIUM] CVE-2020-28500: node-lodash - Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of ...
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Scope: local
bookworm: resolved (fixed in 4.17.21+dfsg+~cs8.31.173-1)
bullseye: resolved (fixed in 4.17.21+dfsg+~cs8.31.173-1)
forky: resolved (fixed in 4.17.21+dfsg+~cs8.31.173-1)
sid: resolved (fixed in 4.17.21+dfsg+~cs8.31.173-1)
trixie: resolved (fixed in 4.17.21+dfsg+~cs8.31.173-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdfhttps://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8https://github.com/lodash/lodash/pull/5065https://security.netapp.com/advisory/ntap-20210312-0006/https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893https://snyk.io/vuln/SNYK-JS-LODASH-1018905https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdfhttps://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8https://github.com/lodash/lodash/pull/5065https://security.netapp.com/advisory/ntap-20210312-0006/https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893https://snyk.io/vuln/SNYK-JS-LODASH-1018905https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2021-02-15
Published