Skip to content

Commit 5c19af4

Browse files
KashKondakaAWSHurneyt
KashKondaka
and
AWSHurneyt
authored
* Resolve CVE-2026-4800 by bumping lodash and lodash-es to ^4.18.0 Details: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function(). Impact: When an application passes untrusted input as options.imports key names to _.template, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, prototype pollution can be exploited via assignInWith to inject keys into the Function() constructor. Fix: Bumped lodash and lodash-es resolutions to ^4.18.0 in package.json. Version 4.18.0 validates importsKeys against reForbiddenIdentifierChars and replaces assignInWith with assignWith when merging imports. Signed-off-by: KashKondaka <37753523+KashKondaka@users.noreply.github.com> * Fixed CI workflows to use correct OSD branch. Signed-off-by: Thomas Hurney <hurneyt@amazon.com> * Updated snapshots. Signed-off-by: Thomas Hurney <hurneyt@amazon.com> * Consolidated CVE fixes: added minimatch, yaml, and picomatch resolutions. Signed-off-by: Thomas Hurney <hurneyt@amazon.com> --------- Signed-off-by: KashKondaka <37753523+KashKondaka@users.noreply.github.com> Signed-off-by: Thomas Hurney <hurneyt@amazon.com> Co-authored-by: Thomas Hurney <hurneyt@amazon.com>
1 parent ed08c0d commit 5c19af4

5 files changed

Lines changed: 53 additions & 31 deletions

File tree

‎.github/workflows/cypress-workflow.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
branches:
88
- '*'
99
env:
10-
OPENSEARCH_DASHBOARDS_VERSION: 'main'
10+
OPENSEARCH_DASHBOARDS_VERSION: '3.1'
1111
OPENSEARCH_VERSION: '3.1.0-SNAPSHOT'
1212
SECURITY_ANALYTICS_BRANCH: 'main'
1313
GRADLE_VERSION: '7.6.1'

‎.github/workflows/unit-tests-workflow.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
branches:
88
- "*"
99
env:
10-
OPENSEARCH_DASHBOARDS_VERSION: 'main'
10+
OPENSEARCH_DASHBOARDS_VERSION: '3.1'
1111
jobs:
1212
Get-CI-Image-Tag:
1313
uses: opensearch-project/opensearch-build/.github/workflows/get-ci-image-tag.yml@main

‎package.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
"kind-of": "^6.0.3",
3939
"glob-parent": "^5.1.2",
4040
"ssri": "^6.0.2",
41-
"lodash": "^4.17.21",
41+
"lodash": "^4.18.0",
4242
"hosted-git-info": "^2.8.9",
4343
"json-schema": "^0.4.0",
4444
"ansi-regex": "^5.0.1",
@@ -58,7 +58,11 @@
5858
"ws": "^7.5.10",
5959
"elliptic": "^6.6.1",
6060
"js-yaml": "^4.1.0",
61-
"brace-expansion": "^5.0.5"
61+
"brace-expansion": "^5.0.5",
62+
"lodash-es": "^4.18.0",
63+
"minimatch": "^3.1.4",
64+
"yaml": "^1.10.3",
65+
"picomatch": "^2.3.2"
6266
},
6367
"devDependencies": {
6468
"@babel/plugin-transform-class-properties": "^7.22.9",

‎public/pages/Rules/components/RuleContentViewer/__snapshots__/RuleContentYamlViewer.test.tsx.snap‎

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -262,13 +262,37 @@ exports[`<RuleContentYamlViewer /> spec renders the component 1`] = `
262262
>
263263
-
264264
</span>
265-
265+
https
266266
<span
267-
class="token string"
267+
class="token punctuation"
268268
>
269-
'https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831'
269+
:
270270
</span>
271-
271+
//securelist.com/operation
272+
<span
273+
class="token punctuation"
274+
>
275+
-
276+
</span>
277+
tunnelsnake
278+
<span
279+
class="token punctuation"
280+
>
281+
-
282+
</span>
283+
and
284+
<span
285+
class="token punctuation"
286+
>
287+
-
288+
</span>
289+
moriya
290+
<span
291+
class="token punctuation"
292+
>
293+
-
294+
</span>
295+
rootkit/101831
272296
273297
</span>
274298
<span

‎yarn.lock‎

Lines changed: 17 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1493,10 +1493,10 @@ babel-preset-jest@^27.5.1:
14931493
babel-plugin-jest-hoist "^27.5.1"
14941494
babel-preset-current-node-syntax "^1.0.0"
14951495

1496-
balanced-match@^1.0.0:
1497-
version "1.0.2"
1498-
resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-1.0.2.tgz#e83e3a7e3f300b34cb9d87f615fa0cbf357690ee"
1499-
integrity sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==
1496+
balanced-match@^4.0.2:
1497+
version "4.0.4"
1498+
resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-4.0.4.tgz#bfb10662feed8196a2c62e7c68e17720c274179a"
1499+
integrity sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==
15001500

15011501
base64-js@^1.0.2, base64-js@^1.3.1:
15021502
version "1.5.1"
@@ -1552,13 +1552,12 @@ bn.js@^5.2.1:
15521552
resolved "https://registry.yarnpkg.com/bn.js/-/bn.js-5.2.2.tgz#82c09f9ebbb17107cd72cb7fd39bd1f9d0aaa566"
15531553
integrity sha512-v2YAxEmKaBLahNwE1mjp4WON6huMNeuDvagFZW+ASCuA/ku0bXR9hSMw0XpiqMoA3+rmnyck/tPRSFQkoC9Cuw==
15541554

1555-
brace-expansion@^1.1.7:
1556-
version "1.1.11"
1557-
resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.11.tgz#3c7fcbf529d87226f3d2f52b966ff5271eb441dd"
1558-
integrity sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==
1555+
brace-expansion@^1.1.7, brace-expansion@^5.0.5:
1556+
version "5.0.5"
1557+
resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-5.0.5.tgz#dcc3a37116b79f3e1b46db994ced5d570e930fdb"
1558+
integrity sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==
15591559
dependencies:
1560-
balanced-match "^1.0.0"
1561-
concat-map "0.0.1"
1560+
balanced-match "^4.0.2"
15621561

15631562
braces@^2.3.2, braces@^3.0.3, braces@~3.0.2:
15641563
version "3.0.3"
@@ -1990,11 +1989,6 @@ commondir@^1.0.1:
19901989
resolved "https://registry.yarnpkg.com/commondir/-/commondir-1.0.1.tgz#ddd800da0c66127393cca5950ea968a3aaf1253b"
19911990
integrity sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==
19921991

1993-
concat-map@0.0.1:
1994-
version "0.0.1"
1995-
resolved "https://registry.yarnpkg.com/concat-map/-/concat-map-0.0.1.tgz#d8a96bd77fd68df7793a73036a3ba0d5405d477b"
1996-
integrity sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==
1997-
19981992
concat-stream@^1.5.0:
19991993
version "1.6.2"
20001994
resolved "https://registry.yarnpkg.com/concat-stream/-/concat-stream-1.6.2.tgz#904bdf194cd3122fc675c77fc4ac3d4ff0fd1a34"
@@ -4396,20 +4390,20 @@ locate-path@^5.0.0:
43964390
dependencies:
43974391
p-locate "^4.1.0"
43984392

4399-
lodash-es@^4.17.21:
4400-
version "4.17.21"
4401-
resolved "https://registry.yarnpkg.com/lodash-es/-/lodash-es-4.17.21.tgz#43e626c46e6591b7750beb2b50117390c609e3ee"
4402-
integrity sha512-mKnC+QJ9pWVzv+C4/U3rRsHapFfHvQFoFB92e52xeyGMcX6/OlIl78je1u8vePzYZSkkogMPJ2yjxxsb89cxyw==
4393+
lodash-es@^4.17.21, lodash-es@^4.18.0:
4394+
version "4.18.1"
4395+
resolved "https://registry.yarnpkg.com/lodash-es/-/lodash-es-4.18.1.tgz#b962eeb80d9d983a900bf342961fb7418ca10b1d"
4396+
integrity sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==
44034397

44044398
lodash.once@^4.1.1:
44054399
version "4.1.1"
44064400
resolved "https://registry.yarnpkg.com/lodash.once/-/lodash.once-4.1.1.tgz#0dd3971213c7c56df880977d504c88fb471a97ac"
44074401
integrity sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==
44084402

4409-
lodash@^4.17.15, lodash@^4.17.21, lodash@^4.7.0:
4410-
version "4.17.21"
4411-
resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c"
4412-
integrity sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==
4403+
lodash@^4.17.15, lodash@^4.17.21, lodash@^4.18.0, lodash@^4.7.0:
4404+
version "4.18.1"
4405+
resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.18.1.tgz#ff2b66c1f6326d59513de2407bf881439812771c"
4406+
integrity sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==
44134407

44144408
log-symbols@^4.0.0:
44154409
version "4.1.0"

0 commit comments

Comments
 (0)