CVE-2023-44270
First published: Fri Sep 29 2023(Updated: )
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be `\r` discrepancies, as demonstrated by `@font-face{ font:(\r/*);}` in a rule. This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Postcss Postcss | <8.4.31 | |
| npm/postcss | <8.4.31 | 8.4.31 |
| IBM IBM® Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data | <=v3.5 through refresh 10v4.0 through refresh 9v4.5 through refresh 3v4.6 through refresh 6v4.7 through refresh 4v4.8 through refresh 4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/github/advisory-database/issues/2820
- https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25
- https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5
- https://github.com/postcss/postcss/releases/tag/8.4.31
- https://nvd.nist.gov/vuln/detail/CVE-2023-44270
- https://github.com/advisories/GHSA-7fh5-64p2-3v2j (Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/267473
- https://www.ibm.com/support/pages/node/7155078 (Advisory)
- https://access.redhat.com/errata/RHSA-2024:10517
- https://access.redhat.com/errata/RHSA-2024:10908
- https://bugzilla.redhat.com/show_bug.cgi?id=2326998
Frequently Asked Questions
What is the vulnerability identifier for this issue?
The vulnerability identifier for this issue is CVE-2023-44270.
What is the affected software?
The affected software is PostCSS before 8.4.31.
What is the impact of this vulnerability?
This vulnerability affects linters using PostCSS to parse external Cascading Style Sheets (CSS).
How can I fix this vulnerability?
To fix this vulnerability, upgrade PostCSS to version 8.4.31 or above.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following references: [reference 1](https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25), [reference 2](https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5), [reference 3](https://github.com/postcss/postcss/releases/tag/8.4.31).
- collector/nvd-api
- collector/nvd-index
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-7fh5-64p2-3v2j
- alias/CVE-2023-44270
- collector/github-advisory
- agent/type
- agent/remedy
- agent/weakness
- agent/author
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/description
- agent/event
- agent/references
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- agent/last-modified-date
- agent/trending
- vendor/postcss
- canonical/postcss postcss
- package-manager/npm
- vendor/ibm
- canonical/ibm ibm® db2® on cloud pak for data and db2 warehouse on cloud pak for data
- version/ibm ibm® db2® on cloud pak for data and db2 warehouse on cloud pak for data/v3.5 through refresh 10v4.0 through refresh 9v4.5 through refresh 3v4.6 through refresh 6v4.7 through refresh 4v4.8 through refresh 4