fix(connector-besu): vulnerability cve-2020-8203

[petermetz]

Describe the bug

GHSA-p6mc-m468-83gw

CVE-2020-8203
low severity
Vulnerable versions: < 4.17.19
Patched version: 4.17.19
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The function zipObjectDeep allows a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires zipping objects based on user-provided property arrays.

This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.

Dependabot cannot update lodash to a non-vulnerable version
The latest possible version that can be installed is 4.17.15 because of the following conflicting dependency:

web3-eea@0.9.0 requires lodash@4.17.15
The earliest fixed version is 4.17.19.

1 lodash vulnerability found in …/cactus-test-plugin-ledger-connector-besu/package-lock.json 27 days ago
Remediation
Upgrade lodash to version 4.17.19 or later. For example:

"dependencies": {
  "lodash": ">=4.17.19"
}

or…

"devDependencies": {
  "lodash": ">=4.17.19"
}

Always verify the validity and compatibility of suggestions with your codebase.

To Reproduce

https://github.com/hyperledger/cactus/security/dependabot/packages/cactus-test-plugin-ledger-connector-besu/package-lock.json/lodash/open

cc: @takeutak @sfuji822 @hartm @jonathan-m-hamilton @AzaharaC @jordigiam @kikoncuo

[kikoncuo]

fixed in #581 merge pending