CVE-2021-23368: Regular Expression Denial of Service (ReDoS)
First published: Mon Apr 12 2021(Updated: )
A regular expression denial of service (ReDoS) vulnerability was found in the npm library `postcss`. When parsing a supplied CSS string, if it contains an unexpected value then as the supplied CSS grows in length it will take an ever increasing amount of time to process. An attacker can use this vulnerability to potentially craft a malicious a long CSS value to process resulting in a denial of service.
Credit: report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Postcss Postcss | >=7.0.0<7.0.36 | |
| Postcss Postcss | >=8.0.0<8.2.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-23368 https://nvd.nist.gov/vuln/detail/CVE-2021-23368
- https://bugzilla.redhat.com/show_bug.cgi?id=1948763
- https://access.redhat.com/errata/RHSA-2021:3016
- https://access.redhat.com/errata/RHSA-2021:2438
- https://access.redhat.com/errata/RHSA-2021:3917
- https://access.redhat.com/security/cve/cve-2021-23368
- https://github.com/postcss/postcss/commit/8682b1e4e328432ba692bed52326e84439cec9e4
- https://github.com/postcss/postcss/commit/b6f3e4d5a8d7504d553267f80384373af3a3dec5
- https://lists.apache.org/thread.html/r00158f5d770d75d0655c5eef1bdbc6150531606c8f8bcb778f0627be@%3Cdev.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r16e295b4f02d81b79981237d602cb0b9e59709bafaa73ac98be7cef1@%3Cdev.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r49afb49b38748897211b1f89c3a64dc27f9049474322b05715695aab@%3Cdev.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r5acd89f3827ad9a9cad6d24ed93e377f7114867cd98cfba616c6e013@%3Ccommits.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r8def971a66cf3e375178fbee752e1b04a812a047cc478ad292007e33@%3Cdev.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/rad5af2044afb51668b1008b389ac815a28ecea9eb75ae2cab5a00ebb@%3Ccommits.myfaces.apache.org%3E
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1244795
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1090595
- https://github.com/postcss/postcss/blob/51e35386da38994b441acac0b6e65888b3025756/lib/previous-map.es6#L78
- https://lists.apache.org/thread.html/r16e295b4f02d81b79981237d602cb0b9e59709bafaa73ac98be7cef1%40%3Cdev.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r8def971a66cf3e375178fbee752e1b04a812a047cc478ad292007e33%40%3Cdev.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r00158f5d770d75d0655c5eef1bdbc6150531606c8f8bcb778f0627be%40%3Cdev.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r5acd89f3827ad9a9cad6d24ed93e377f7114867cd98cfba616c6e013%40%3Ccommits.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/rad5af2044afb51668b1008b389ac815a28ecea9eb75ae2cab5a00ebb%40%3Ccommits.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r49afb49b38748897211b1f89c3a64dc27f9049474322b05715695aab%40%3Cdev.myfaces.apache.org%3E
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2021-23368?
CVE-2021-23368 is a vulnerability found in the npm library `postcss` that allows for a regular expression denial of service (ReDoS) attack.
How does CVE-2021-23368 work?
CVE-2021-23368 works by exploiting a vulnerability in the way the postcss library parses a CSS string, causing a significant increase in processing time as the string grows.
What is the severity of CVE-2021-23368?
The severity of CVE-2021-23368 is medium, with a severity value of 5.3.
What software versions are affected by CVE-2021-23368?
The affected software versions include postcss versions up to and excluding 8.2.10, as well as node.js versions between 7.0.0 and 7.0.36 for the Postcss package.
How can I fix CVE-2021-23368?
To fix CVE-2021-23368, you should update the Postcss package to version 8.2.10 or later.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/author
- agent/weakness
- agent/severity
- agent/remedy
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-23368
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/references
- agent/tags
- agent/event
- agent/description
- vendor/postcss
- canonical/postcss postcss
- version/postcss postcss/7.0.0
- version/postcss postcss/8.0.0
- package-manager/redhat