PT-2021-10998 · Npm+3 · Node-Sass+3

Liujinghao + 1 · Published 2021-01-11 · Updated 2022-04-01 · CVE-2020-24025

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: node-sass versions 2.0.0 through 6.0.1

Description: The issue is related to disabled certificate validation in node-sass when requesting binaries, even if the user does not specify an alternative download path. This affects certain versions of eZ Platform, ezsystems/ezplatform, and ezsystems/ezplatform-page-builder. The maintainers resolved the issue by replacing node-sass with sass.

Recommendations: For node-sass versions 2.0.0 through 6.0.1, consider replacing node-sass with sass 1.32.13 or a later version to resolve the issue. For eZ Platform v2.5, update to a version that uses sass instead of node-sass. At the moment, there is no information about other specific fixes for this issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

AZL-27653

CVE-2020-24025

GHSA-6V6P-G8CG-2HGG

GHSA-R8F7-9PFQ-MJMV

Affected Products

Debian

Ez Platform

Node-Sass

Sass

References · 24

• https://nvd.nist.gov/vuln/detail/CVE-2020-24025 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24025 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-24025 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24025 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-27653 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-24025 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-24025 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-24025 · Security Note
• https://osv.dev/vulnerability/GHSA-r8f7-9pfq-mjmv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6v6p-g8cg-2hgg · Vendor Advisory
• https://github.com/sass/node-sass/releases/tag/v7.0.0 · Note
• https://github.com/sass/node-sass/issues/3067 · Note
• https://github.com/sass/node-sass/commit/0a21792803639851b480fbd8cbcb5540ef974387 · Note
• https://github.com/sass/node-sass/pull/3149 · Note
• https://github.com/sass/node-sass · Note