Summary
It was discovered that css-what incorrectly handled certain inputs. If a user
or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2021-33587, CVE-2022-21222)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | node-css-what | 2.1.0-1+deb10u1build0.18.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | node-css-what | 2.1.0-1ubuntu0.16.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | node-css-what | 3.2.1-1ubuntu0.1~esm1 |
Vulnerabilities 2
-
High 7.5
Denial of service in css-what
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse funct…