-
Notifications
You must be signed in to change notification settings - Fork 0
Description
CVE-2021-23364 - Medium Severity Vulnerability
Vulnerable Libraries - browserslist-4.14.0.tgz, browserslist-4.8.3.tgz
browserslist-4.14.0.tgz
Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset
Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.14.0.tgz
Path to dependency file: /deps/npm/docs/package.json
Path to vulnerable library: /deps/npm/docs/package.json
Dependency Hierarchy:
- gatsby-2.23.20.tgz (Root Library)
- ❌ browserslist-4.14.0.tgz (Vulnerable Library)
browserslist-4.8.3.tgz
Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset
Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.8.3.tgz
Path to dependency file: /deps/npm/docs/package.json
Path to vulnerable library: /deps/npm/docs/node_modules/stylehacks/node_modules/browserslist/package.json,/deps/npm/docs/node_modules/postcss-colormin/node_modules/browserslist/package.json,/deps/npm/docs/node_modules/postcss-reduce-initial/node_modules/browserslist/package.json,/deps/npm/docs/node_modules/caniuse-api/node_modules/browserslist/package.json,/deps/npm/docs/node_modules/postcss-minify-params/node_modules/browserslist/package.json,/deps/npm/docs/node_modules/postcss-merge-rules/node_modules/browserslist/package.json,/deps/npm/docs/node_modules/postcss-normalize-unicode/node_modules/browserslist/package.json,/deps/npm/docs/package.json
Dependency Hierarchy:
- gatsby-2.23.20.tgz (Root Library)
- optimize-css-assets-webpack-plugin-5.0.3.tgz
- cssnano-4.1.10.tgz
- cssnano-preset-default-4.0.7.tgz
- postcss-normalize-unicode-4.0.1.tgz
- ❌ browserslist-4.8.3.tgz (Vulnerable Library)
- postcss-normalize-unicode-4.0.1.tgz
- cssnano-preset-default-4.0.7.tgz
- cssnano-4.1.10.tgz
- optimize-css-assets-webpack-plugin-5.0.3.tgz
Found in HEAD commit: ec9a3f8a365636d40076233e59d310f9ec5e9c96
Found in base branch: master
Vulnerability Details
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Publish Date: 2021-04-28
URL: CVE-2021-23364
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364
Release Date: 2021-04-28
Fix Resolution (browserslist): 4.16.5
Direct dependency fix Resolution (gatsby): 2.23.21-oom-exit-code.13
Fix Resolution (browserslist): 4.16.5
Direct dependency fix Resolution (gatsby): 2.23.21-oom-exit-code.13
Step up your Open Source Security Game with Mend here