Quick answers
- Is CVE-2021-23368 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-23368 being exploited in the wild.
- How severe is CVE-2021-23368?
- Low severity, with a CVSS score of 3.1, published 10 May 2021.
- Which products and versions are affected?
- postcss (npm) SEMVER:introduced=7.0.0,fixed=7.0.36.
- Is there a fix for CVE-2021-23368?
- Yes. postcss (npm): upgrade to 7.0.36 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-23368 attacked?
- It is attacked over the network.
- Am I affected by CVE-2021-23368?
- Check whether you run postcss (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- postcss (npm): upgrade to 7.0.36 or later
npm install postcss@7.0.36
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in postcss versions 7.0.0 through 7.0.35 and 8.0.0 through 8.2.9, specifically in the source map parsing component (previous-map.es6). The vulnerability arises from a poorly constructed regular expression that exhibits catastrophic backtracking behavior when processing input with certain patterns. An attacker can supply a maliciously crafted CSS file with a specially crafted source map to trigger excessive regex engine resource consumption, causing the application to hang or become unresponsive. The attack requires network reachability to deliver the malicious CSS/source map to an application using postcss, with no authentication required. Patches are available in versions 7.0.36 and 8.2.10 and later.
Affected products
- postcss postcss 7.0.0 through 7.0.35, 8.0.0 through 8.2.9
Identifiers
- CVE-2021-23368
- GHSA-hwj9-h5mp-3pm3
Timeline
- 2021-04-12: disclosed
- 2021-05-10: advisory
- 2021-05-07: patched