CVE:CVE-2019-10744
CNNVD:CNNVD-201907-1352
lodash是一款开源的JavaScript实用程序库。
lodash 4.17.12之前版本中存在安全漏洞。攻击者可借助defaultsDeep参数利用该漏洞添加或修改Object.prototype的对象。
solution:Upgrade lodash lodash to a higher version than 4.17.12,and avoid the version (,4.17.12); Upgrade netapp service_level_manager to a higher version than -; Upgrade redhat virtualization_manager to a higher version than 4.3,and avoid the version 4.3; Upgrade oracle banking_extensibility_workbench to a higher version than 14.3.0,14.4.0,and avoid the version 14.3.0,14.4.0; Upgrade f5 big-ip_access_policy_manager to a higher version than 12.1.5.2,13.1.3.4,14.1.2.5,15.0.1.4,15.1.0.2,and avoid the version [12.1.0,12.1.5.2),[13.1.0,13.1.3.4),[14.1.0,14.1.2.5),[15.0.0,15.0.1.4),[15.1.0,15.1.0.2); Upgrade f5 big-ip_advanced_firewall_manager to a higher version than 12.1.5.2,13.1.3.4,14.1.2.5,15.0.1.4,15.1.0.2,and avoid the version [12.1.0,12.1.5.2),[13.1.0,13.1.3.4),[14.1.0,14.1.2.5),[15.0.0,15.0.1.4),[15.1.0,15.1.0.2); Upgrade f5 big-ip_analytics to a higher version than 12.1.5,13.1.3,14.1.2,15.0.1.3,15.1.0.2,and avoid the version [12.1.0,12.1.5],[13.1.0,13.1.3],[14.1.0,14.1.2],[15.0.0,15.0.1.3),[15.1.0,15.1.0.2); Upgrade f5 big-ip_application_acceleration_manager to a higher version than 12.1.5.2,13.1.3.4,14.1.2.5,15.0.1.4,15.1.0.2,and avoid the version [12.1.0,12.1.5.2),[13.1.0,13.1.3.4),[14.1.0,14.1.2.5),[15.0.0,15.0.1.4),[15.1.0,15.1.0.2); Upgrade f5 big-ip_application_security_manager to a higher version than 12.1.5.2,13.1.3.4,14.1.2.5,15.0.1.4,15.1.0.2,and avoid the version [12.1.0,12.1.5.2),[13.1.0,13.1.3.4),[14.1.0,14.1.2.5),[15.0.0,15.0.1.4),[15.1.0,15.1.0.2); Upgrade f5 big-ip_application_visibility_and_reporting to a higher version than 12.1.5.2,13.1.3,14.1.2.5,15.1.1,and avoid the version [12.1.0,12.1.5.2),[13.1.0,13.1.3],[14.1.0,14.1.2.5),[15.1.0,15.1.1); Upgrade f5 big-ip_domain_name_system to a higher version than 12.1.5.2,13.1.3.4,14.1.2.5,15.0.1.4,15.1.0.2,and avoid the version [12.1.0,12.1.5.2),[13.1.0,13.1.3.4),[14.1.0,14.1.2.5),[15.0.0,15.0.1.4),[15.1.0,15.1.0.2); Upgrade f5 big-ip_edge_gateway to a higher version than 12.1.5.2,13.1.3.4,14.1.2.5,15.0.1.4,15.1.0.2,and avoid the version [12.1.0,12.1.5.2),[13.1.0,13.1.3.4),[14.1.0,14.1.2.5),[15.0.0,15.0.1.4),[15.1.0,15.1.0.2); Upgrade f5 big-ip_fraud_protection_service to a higher version than 12.1.5.2,13.1.3.4,14.1.2.5,15.0.1.4,15.1.0.2,and avoid the version [12.1.0,12.1.5.2),[13.1.0,13.1.3.4),[14.1.0,14.1.2.5),[15.0.0,15.0.1.4),[15.1.0,15.1.0.2); Upgrade f5 big-ip_global_traffic_manager to a higher version than 12.1.5.2,13.1.3.4,14.1.2.5,15.0.1.4,15.1.0.2,and avoid the version [12.1.0,12.1.5.2),[13.1.0,13.1.3.4),[14.1.0,14.1.2.5),[15.0.0,15.0.1.4),[15.1.0,15.1.0.2); Upgrade f5 big-ip_link_controller to a higher version than 12.1.5.2,13.1.3.4,14.1.2.5,15.0.1.4,15.1.0.2,and avoid the version [12.1.0,12.1.5.2),[13.1.0,13.1.3.4),[14.1.0,14.1.2.5),[15.0.0,15.0.1.4),[15.1.0,15.1.0.2); Upgrade f5 big-ip_local_traffic_manager to a higher version than 12.1.5.2,13.1.3.4,14.1.2.5,15.0.1.4,15.1.0.2,and avoid the version [12.1.0,12.1.5.2),[13.1.0,13.1.3.4),[14.1.0,14.1.2.5),[15.0.0,15.0.1.4),[15.1.0,15.1.0.2); Upgrade f5 big-ip_policy_enforcement_manager to a higher version than 12.1.5.2,13.1.3.4,14.1.2.5,15.0.1.4,15.1.0.2,and avoid the version [12.1.0,12.1.5.2),[13.1.0,13.1.3.4),[14.1.0,14.1.2.5),[15.0.0,15.0.1.4),[15.1.0,15.1.0.2); Upgrade f5 big-ip_webaccelerator to a higher version than 12.1.5.2,13.1.3.4,14.1.2.5,15.0.1.4,15.1.0.2,and avoid the version [12.1.0,12.1.5.2),[13.1.0,13.1.3.4),[14.1.0,14.1.2.5),[15.0.0,15.0.1.4),[15.1.0,15.1.0.2); Upgrade f5 big-iq_centralized_management to a higher version than 6.1.0,5.4.0,7.0.0,and avoid the version [6.0.0,6.1.0],5.4.0,7.0.0; Upgrade f5 iworkflow to a higher version than 2.3.0,and avoid the version 2.3.0