Regular Expression Denial of Service (ReDoS)
CVE-2021-23368

5.3MEDIUM

Key Information:

Vendor

Postcss

Status
Postcss
Vendor
CVE Published:
12 April 2021

What is CVE-2021-23368?

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

Affected Version(s)

postcss 7.0.0

postcss < 8.2.10

References

https://snyk.io/vuln/SNYK-JS-POSTCSS-1090595
x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1244795
x_refsource_MISC
https://github.com/postcss/postcss/commit/b6f3e4d5a8d7504...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yeting Li
.