Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix CVE–2021–23382 #4

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

debricked[bot]
Copy link

@debricked debricked bot commented Mar 23, 2022

CVE–2021–23382

Vulnerable dependency:     postcss (npm)    7.0.36

Vulnerability details

Description

NVD

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

GitHub

Regular Expression Denial of Service in postcss

The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

CVSS details - 7.5

 

CVSS3 metrics
Attack Vector Network
Attack Complexity Low
Privileges Required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High
References

    THIRD PARTY
    Regular Expression Denial of Service in postcss · CVE-2021-23382 · GitHub Advisory Database · GitHub
    Merge pull request #1567 from yetingli/main · postcss/postcss@2b1d04c · GitHub
    Release 7.0.36 · postcss/postcss · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE

 

@debricked debricked bot force-pushed the debricked-fix-CVE_2021_23382-d0582f89205aaa65 branch from 3c5d10c to d62e671 Compare October 24, 2022 14:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

0 participants