PT-2021-15478 · Postcss · Postcss

Yeting Li · Published 2021-04-26 · Updated 2023-08-08 · CVE-2021-23382

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions postcss versions prior to 7.0.36 postcss versions 8.0.0 through 8.2.13

Description The issue is related to Regular Expression Denial of Service (ReDoS) via the getAnnotationURL() and loadAnnotation() functions in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*s* sourceMappingURL=(.*). This can lead to a denial of service when parsing specific CSS strings.

Recommendations For postcss versions prior to 7.0.36, update to version 7.0.36 or later. For postcss versions 8.0.0 through 8.2.13, update to version 8.2.13 or later. As a temporary workaround, consider disabling the getAnnotationURL() and loadAnnotation() functions in lib/previous-map.js until a patch is available. Restrict access to the lib/previous-map.js module to minimize the risk of exploitation. Avoid using the sourceMappingURL parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

Related Identifiers

CVE-2021-23382

GHSA-566M-QJ78-RWW5

SNYK-JAVA-ORGWEBJARSNPM-1255641

SNYK-JS-POSTCSS-1255640

Affected Products

Postcss

References · 14

• 🔥 https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641 · Exploit
• https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-23382 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-23382 · Security Note
• https://ubuntu.com/security/CVE-2021-23382 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23382 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23382 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-23382 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-23382 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-566m-qj78-rww5 · Vendor Advisory
• https://github.com/postcss/postcss/releases/tag/7.0.36 · Note
• https://github.com/postcss/postcss/commit/2ad1ca9b965dde32223bee28dc259c339cbaaa05 · Note
• https://t.me/cvenotify/36452 · Telegram Post