CVE-2019-10744 (High) detected in lodash-4.17.11.tgz
Closed this issue · 0 comments
mend-bolt-for-github commented
CVE-2019-10744 - High Severity Vulnerability
Vulnerable Library - lodash-4.17.11.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz
Path to dependency file: /Motus/package.json
Path to vulnerable library: /tmp/git/Motus/node_modules/lodash/package.json
Dependency Hierarchy:
- pug-2.0.4.tgz (Root Library)
- pug-code-gen-2.0.2.tgz
- constantinople-3.1.2.tgz
- babel-types-6.26.0.tgz
- ❌ lodash-4.17.11.tgz (Vulnerable Library)
- babel-types-6.26.0.tgz
- constantinople-3.1.2.tgz
- pug-code-gen-2.0.2.tgz
Found in HEAD commit: c1fdedad482cb05119928f409cef33a9be6ca0fe
Vulnerability Details
A Prototype Pollution vulnerability was found in lodash through version 4.17.11.
Publish Date: 2019-07-08
URL: CVE-2019-10744
Suggested Fix
Type: Upgrade version
Origin: lodash/lodash@a01e4fa
Release Date: 2019-07-08
Fix Resolution: 4.17.12
Step up your Open Source Security Game with WhiteSource here