CVE-2021-33587
First published: Fri May 28 2021(Updated: )
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Css-what Project Css-what | =4.0.0 | |
| Css-what Project Css-what | =5.0.0 | |
| Netapp E-series Performance Analyzer | ||
| npm/css-what | >=4.0.0<=5.0.0 | 5.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/fb55/css-what/releases/tag/v5.0.1
- https://lists.debian.org/debian-lts-announce/2023/03/msg00001.html
- https://security.netapp.com/advisory/ntap-20210706-0007/
- https://nvd.nist.gov/vuln/detail/CVE-2021-33587
- https://github.com/fb55/css-what/commit/4cdaacfd0d4b6fd00614be030da0dea6c2994655
- https://github.com/advisories/GHSA-q8pj-2vqx-8ggc (Advisory)
Frequently Asked Questions
What is the severity of CVE-2021-33587?
The severity of CVE-2021-33587 is high with a severity value of 7.5.
Which software versions are affected by CVE-2021-33587?
The css-what package versions 4.0.0 through 5.0.0 for Node.js are affected by CVE-2021-33587.
How does CVE-2021-33587 impact the css-what package for Node.js?
CVE-2021-33587 impacts the css-what package for Node.js by not ensuring that attribute parsing has Linear Time Complexity relative to the size of the input.
Is there a fix available for CVE-2021-33587?
Yes, a fix is available for CVE-2021-33587. It can be found in the css-what package version 5.0.1.
Where can I find more information about CVE-2021-33587?
More information about CVE-2021-33587 can be found at the following references: [Reference 1](https://github.com/fb55/css-what/releases/tag/v5.0.1), [Reference 2](https://lists.debian.org/debian-lts-announce/2023/03/msg00001.html), [Reference 3](https://security.netapp.com/advisory/ntap-20210706-0007/).
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-q8pj-2vqx-8ggc
- alias/CVE-2021-33587
- collector/nvd-cve
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/references
- agent/severity
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- agent/trending
- vendor/css-what project
- canonical/css-what project css-what
- version/css-what project css-what/4.0.0
- version/css-what project css-what/5.0.0
- vendor/netapp
- canonical/netapp e-series performance analyzer
- package-manager/npm