CVE-2021-23382

Description

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*s* sourceMappingURL=(.*).

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.071

Associated Vulnerability

Vulnerability	OS Platform
Multiple Vulnerabilities are affected in IBM Business Automation Workflow 20.0.0.2	Windows
Multiple Vulnerabilities are affected in IBM Business Automation Workflow 18.0.0.1	Windows
Multiple Vulnerabilities are affected in IBM Business Automation Workflow 19.0.0.3	Windows
Multiple Vulnerabilities are affected in IBM Business Automation Workflow 21.0.2	Windows
Multiple Vulnerabilities are affected in IBM Business Automation Workflow 21.0.3	Windows
Multiple Vulnerabilities are affected in IBM Planning Analytics Local 2.0	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234