Project

General

Profile

Actions
Copy link

Bug #39081

closed

lodash: Bump from 4.17.21 to 4.17.23 due to CVE-2025-13465

Added by Maximilian Kolb 5 months ago. Updated 4 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Maximilian Kolb
Category:
RPMs
Target version:
-
Difficulty:
Triaged:
No
Bugzilla link:
Pull request:
Fixed in Releases:
Foreman - 3.19.0
Found in Releases:
Foreman - 3.16.3, Foreman - 3.17.0, Foreman - 3.17.1, Foreman - 3.18.0, Foreman - 3.19.0
Red Hat JIRA:

Description

Various RPMs in foreman-packaging reference lodash in a version that is affected by a CVE. As of now, only the source of "nodejs-lodash" has been fixed.

Refs https://www.cve.org/CVERecord?id=CVE-2025-13465
Refs https://github.com/theforeman/foreman-packaging/pull/12939

Actions
Copy link
 #1

Updated by The Foreman Bot 5 months ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman-packaging/pull/13038 added
Actions
Copy link
 #2

Updated by The Foreman Bot 4 months ago

  • Pull request deleted (https://github.com/theforeman/foreman-packaging/pull/13038)
Actions
Copy link
 #3

Updated by Evgeni Golov 4 months ago

  • Status changed from Ready For Testing to Closed
  • Fixed in Releases 3.19.0 added
Actions
Copy link

Also available in: Atom PDF