CVE-2021-23382

Опубликовано: 26 апр. 2021

Источник: nvd

CVSS3: 5.3

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Ссылки

https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641
Exploit
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
Exploit
Patch
Third Party Advisory
https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641
Exploit
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:postcss:postcss:*:*:*:*:*:node.js:*:*

Версия до 7.0.36 (исключая)

cpe:2.3:a:postcss:postcss:*:*:*:*:*:node.js:*:*

Версия от 8.0.0 (включая) до 8.2.13 (исключая)

EPSS

Процентиль: 22%

0.00071

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-1333

Связанные уязвимости

CVE-2021-23382

CVSS3: 5.3

ubuntu

почти 5 лет назад

CVE-2021-23382

CVSS3: 5.3

redhat

почти 5 лет назад

CVE-2021-23382

CVSS3: 5.3

debian

почти 5 лет назад

The package postcss before 8.2.13 are vulnerable to Regular Expression ...

GHSA-566m-qj78-rww5

CVSS3: 5.3

github

около 4 лет назад

Regular Expression Denial of Service in postcss

EPSS

Процентиль: 22%

0.00071

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-1333