Vulnerability Description
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Postcss | Postcss | < 7.0.36 |
Related Weaknesses (CWE)
References
- https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c17359PatchThird Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641ExploitPatchThird Party Advisory
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640ExploitPatchThird Party Advisory
- https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c17359PatchThird Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641ExploitPatchThird Party Advisory
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640ExploitPatchThird Party Advisory
FAQ
What is CVE-2021-23382?
CVE-2021-23382 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused m...
How severe is CVE-2021-23382?
CVE-2021-23382 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-23382?
Check the references section above for vendor advisories and patch information. Affected products include: Postcss Postcss.