CVE-2021-23368

EUVD-2021-1108
The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
snykCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 52%
Affected Products (NVD)
VendorProductVersion
postcsspostcss
7.0.0 ≤
𝑥
< 7.0.36
postcsspostcss
8.0.0 ≤
𝑥
< 8.2.10
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
node-postcss
bookworm
8.4.20+~cs8.0.23-1
fixed
bullseye
8.2.1+~cs5.3.23-8
fixed
buster
not-affected
sid
8.4.39+~cs9.2.29-1
fixed
trixie
8.4.39+~cs9.2.29-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-postcss
bionic
dne
focal
not-affected
groovy
ignored
hirsute
ignored
impish
ignored
jammy
needed
kinetic
ignored
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
dne
xenial
dne
References