GHSA-wxhq-pm8v-cw75

Source

https://github.com/advisories/GHSA-wxhq-pm8v-cw75

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-wxhq-pm8v-cw75/GHSA-wxhq-pm8v-cw75.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wxhq-pm8v-cw75

Downstream

CLSA (2)

Published

2019-06-05T20:50:16Z

Modified

2020-08-31T18:35:40Z

Summary

Regular Expression Denial of Service in clean-css

Details

Version of clean-css prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Recommendation

Upgrade to version 4.1.11 or higher.

Database specific

{
    "cwe_ids":  [
        "CWE-1333"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2019-06-05T20:49:47Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

npm / clean-css

Package

Name: clean-css; View open source insights on deps.dev
Purl: pkg:npm/clean-css

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.1.11

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-wxhq-pm8v-cw75/GHSA-wxhq-pm8v-cw75.json"