Skip to content

Bump lodash from 4.17.13 to 4.17.19 #5346

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 20, 2020
Merged

Conversation

ahinkle
Copy link
Contributor

@ahinkle ahinkle commented Jul 20, 2020

Bumps lodash from 4.17.13 to 4.17.19 to fix a security vulnerability. Most Laravel applications should not be affected but this PR will prevent the "security vulnerability" alert from GitHub on newly created Laravel applications.

GHSA-p6mc-m468-83gw

Sourced from The GitHub Security Advisory Database:

Prototype Pollution in lodash
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The function zipObjectDeep allows a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires zipping objects based on user-provided property arrays.

This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.

Affected versions: ["< 4.17.19"]

@ahinkle ahinkle changed the title Bump lodash from 4.17.15 to 4.17.19 Bump lodash from 4.17.13 to 4.17.19 Jul 20, 2020
@driesvints driesvints merged commit 6d9296c into laravel:master Jul 20, 2020
@driesvints
Copy link
Member

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants