Описание
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| node-css-what | fixed | 5.0.1-1 | package | |
| node-css-what | fixed | 4.0.0-3+deb11u1 | bullseye | package |
| node-css-what | ignored | buster | package | |
| node-css-what | end-of-life | stretch | package |
Примечания
https://github.com/fb55/css-what/commit/4cdaacfd0d4b6fd00614be030da0dea6c2994655
https://github.com/fb55/css-what/releases/tag/v5.0.1
EPSS
Связанные уязвимости
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
Уязвимость анализатора селекторов CSS Node-css-what, связанная с использованием памяти после освобождения, позволяющая нарушителю вызвать отказ в обслуживании
EPSS