Описание
css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0.
A flaw was found in the css_parser Ruby gem prior to 2.1.0 and 1.22.0. When stylesheets are fetched over HTTPS, connections are opened with OpenSSL::SSL::VERIFY_NONE, so certificate validation is skipped. A network MITM attacker can present an untrusted certificate and inject or modify CSS returned to the parser.
Отчет
css_parser is vulnerable to MITM modification of HTTPS-fetched stylesheets because it disables TLS certificate verification (VERIFY_NONE). A remote network attacker positioned on the path can alter CSS content delivered to consumers that load remote stylesheets through the gem. Fixed in css_parser 2.1.0 and 1.22.0.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/system | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/system | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel7 | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel8 | Fix deferred | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.8 Medium
CVSS3
Связанные уязвимости
css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0.
css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0.
css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Pa ...
CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content
EPSS
5.8 Medium
CVSS3