CVE-2020-8203
Fixed in a distro release EPSS 5%
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Products: lodash, oracle banking_corporate_lending_process_management, oracle banking_credit_facilities_process_management, oracle banking_extensibility_workbench, oracle banking_liquidity_management, oracle banking_supply_chain_finance, oracle banking_trade_finance_process_management, oracle banking_virtual_account_management, oracle blockchain_platform, oracle communications_billing_and_revenue_management, oracle communications_cloud_native_core_policy, oracle communications_session_border_controller, oracle communications_session_router, oracle communications_subscriber-aware_load_balancer, oracle enterprise_communications_broker, oracle jd_edwards_enterpriseone_tools, oracle peoplesoft_enterprise_peopletools, oracle primavera_gateway
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | lodash-rails | 4.17.19 |
| npm | lodash | 4.17.19 |
| npm | lodash-es | 4.17.20 |
| npm | lodash.pick | no fix |
| npm | lodash.set | no fix |
| npm | lodash.setwith | no fix |
| npm | lodash.update | no fix |
| npm | lodash.updatewith | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | node-lodash | 4.17.19+dfsg-1 |
| Debian 13 | node-lodash | 4.17.19+dfsg-1 |
| Debian 14 | node-lodash | 4.17.19+dfsg-1 |
| Red Hat rhev hypervisor 4.4 | cockpit-ovirt | 0:0.14.15-1.el8ev |
| Red Hat rhev hypervisor 4.4 | cockpit-ovirt-dashboard | 0:0.14.15-1.el8ev |
| Red Hat rhev hypervisor 4.4 | redhat-virtualization-host | 0:4.4.3-20201210.0.el8_3 |
| Red Hat rhev hypervisor 4.4 | redhat-virtualization-host-image-update | 0:4.4.3-20201210.0.el8_3 |
| Red Hat rhev manager 4.4 el8 | ovirt-engine | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-backend | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-backend | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-dbscripts | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-dbscripts | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-health-check-bundler | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-health-check-bundler | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-restapi | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-restapi | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-base | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-base | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-cinderlib | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-cinderlib | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-imageio | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-imageio | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-ovirt-engine | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-ovirt-engine | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-ovirt-engine-common | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-ovirt-engine-common | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-vmconsole-proxy-helper | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-vmconsole-proxy-helper | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-websocket-proxy | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-websocket-proxy | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-tools | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-tools | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-tools-backup | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-tools-backup | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-ui-extensions | 0:1.2.3-1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-vmconsole-proxy-helper | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-vmconsole-proxy-helper | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-webadmin-portal | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-webadmin-portal | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-websocket-proxy | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-websocket-proxy | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-web-ui | 0:1.6.4-1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-web-ui | 0:1.6.5-1.el8ev |
| Red Hat rhev manager 4.4 el8 | python3-ovirt-engine-lib | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | python3-ovirt-engine-lib | 0:4.4.2.3-0.6.el8ev |
| Red Hat rhev manager 4.4 el8 | rhvm | 0:4.4.3.8-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | rhvm | 0:4.4.2.3-0.6.el8ev |
| Red Hat service mesh 1.1 | ior | 0:1.1.6-1.el8 |
| Red Hat service mesh 1.1 | kiali | 0:v1.12.10.redhat2-1.el7 |
| Red Hat service mesh 1.1 | servicemesh | 0:1.1.6-1.el8 |
| Red Hat service mesh 1.1 | servicemesh-citadel | 0:1.1.6-1.el8 |
| Red Hat service mesh 1.1 | servicemesh-cni | 0:1.1.6-1.el8 |
| Red Hat service mesh 1.1 | servicemesh-galley | 0:1.1.6-1.el8 |
| Red Hat service mesh 1.1 | servicemesh-grafana | 0:6.4.3-13.el8 |
| Red Hat service mesh 1.1 | servicemesh-grafana-prometheus | 0:6.4.3-13.el8 |
| Red Hat service mesh 1.1 | servicemesh-istioctl | 0:1.1.6-1.el8 |
| Red Hat service mesh 1.1 | servicemesh-mixc | 0:1.1.6-1.el8 |
| Red Hat service mesh 1.1 | servicemesh-mixs | 0:1.1.6-1.el8 |
| Red Hat service mesh 1.1 | servicemesh-operator | 0:1.1.6-2.el8 |
| Red Hat service mesh 1.1 | servicemesh-pilot-agent | 0:1.1.6-1.el8 |
| Red Hat service mesh 1.1 | servicemesh-pilot-discovery | 0:1.1.6-1.el8 |
| Red Hat service mesh 1.1 | servicemesh-prometheus | 0:2.14.0-14.el8 |
| Red Hat service mesh 1.1 | servicemesh-sidecar-injector | 0:1.1.6-1.el8 |
| Ubuntu 25.10 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1 |
| Ubuntu Pro 16.04 LTS | node-lodash | 2.4.1+dfsg-3ubuntu0.1~esm1 |
| Ubuntu Pro 18.04 LTS | node-lodash | 4.17.4+dfsg-1ubuntu0.1~esm1 |
| Ubuntu Pro 20.04 LTS | node-lodash | 4.17.15+dfsg-2ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1 |
| Ubuntu Pro 24.04 LTS | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 |
| Ubuntu Pro 26.04 LTS | node-lodash | 4.17.23+dfsg-1ubuntu0.1~esm1 |