Bug 1948763 (CVE-2021-23368)
| Summary: | CVE-2021-23368 nodejs-postcss: Regular expression denial of service during source map parsing | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alegrand, anpicker, aos-bugs, aturgema, bcoca, bdettelb, bmontgom, chousekn, cmeyers, davidn, dblechte, dfediuck, eedri, eparis, erooth, gblomqui, gghezzo, gparvin, jburrell, jcammara, jcantril, jhadvig, jhardy, jobarker, jokerman, jramanat, jweiser, jwendell, kakkoyun, kaycoth, kconner, lcosic, mabashia, mgoldboi, michal.skrivanek, notting, nstielau, osapryki, pkrupa, rcernich, relrod, rfreiman, sbonazzo, sdoran, sgratch, sherold, smcdonal, sponnaga, stcannon, surbania, thee, tkuratom, tomckay, twalsh, vmugicag, yturgema |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | postcss 8.2.10 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A regular expression denial of service (ReDoS) vulnerability was found in the npm library `postcss`. When parsing a supplied CSS string, if it contains an unexpected value then as the supplied CSS grows in length it will take an ever increasing amount of time to process. An attacker can use this vulnerability to potentially craft a malicious a long CSS value to process resulting in a denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-07-28 01:07:24 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1949771, 1949772, 1949773, 1949774, 1949775, 1949776, 1952383, 1952384, 1952385, 1952386, 1984014, 1984016 | ||
| Bug Blocks: | 1948765 | ||
|
Description
Pedro Sampaio
2021-04-12 21:04:29 UTC
Snyk is reporting from 7.0.0 to 8.2.10 but I believe that's not quite right. The fix is here: https://github.com/postcss/postcss/commit/8682b1e4e328432ba692bed52326e84439cec9e4 And that regex appears in versions before too: https://github.com/postcss/postcss/blob/51e35386da38994b441acac0b6e65888b3025756/lib/previous-map.es6#L78 Looks like the regex was actually introduced in 3.0.0 as 2.2.6 does not increase in time to process. Running the redos attack using v6.0.23 (or v3.0.0) of the library, we can see the same affect can be created as v7.0.0 with an ever increasing amount of time taken: attack_str.length: 10025: 116 ms attack_str.length: 20025: 450 ms attack_str.length: 30025: 1006 ms attack_str.length: 40025: 1848 ms attack_str.length: 50025: 2817 ms attack_str.length: 60025: 4008 ms attack_str.length: 70025: 5468 ms attack_str.length: 80025: 7169 ms attack_str.length: 90025: 9046 ms vs the fixed version v8.2.10 (or v2.2.6, it isn't as good but still an average of 20ms for each iteration): attack_str.length: 10025: 2 ms attack_str.length: 20025: 2 ms attack_str.length: 30025: 1 ms attack_str.length: 40025: 2 ms attack_str.length: 50025: 2 ms attack_str.length: 60025: 2 ms attack_str.length: 70025: 2 ms attack_str.length: 80025: 4 ms attack_str.length: 90025: 3 ms attack_str.length: 100025: 3 ms attack_str.length: 110025: 4 ms attack_str.length: 120025: 4 ms attack_str.length: 130025: 9 ms So I think the versions affected are actually > 2.2.6 < 8.2.10 Quay 3.4 does package a vulnerable version of postcss, but is a dev dependency only and so marked as Low.
"name": "postcss",
"version": "6.0.23",
"ecosystem": "npm",
"dev": true
Statement: In Red Hat OpenShift Container Platform (RHOCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-postcss library to authenticated users only, therefore the impact is low. Red Hat OpenShift Container Platform 4 delivers the kibana package where the nodejs-postcss library is used, but due to the code changing to the container first content the kibana package is marked as wontfix. This may be fixed in the future. In Red Had Quay , whilst a vulnerable version of `postcss` is included in the quay-rhel8 container it is a development dependency only, therefor the impact is low. Analysis is complete. As a result, Its found that the vulnerable npm library i.e. postcss is not being used in any components of AAP. In addition to this, Engineering team has confirmed that they planning to remove it (it will still be an indirect dependency of stylelint, but that doesn't affect runtime). Hence, marking this as "Not Affected" for AAP. This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.8 Via RHSA-2021:2438 https://access.redhat.com/errata/RHSA-2021:2438 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-23368 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 7 Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 Via RHSA-2021:3016 https://access.redhat.com/errata/RHSA-2021:3016 This issue has been addressed in the following products: Red Hat Quay 3 Via RHSA-2021:3917 https://access.redhat.com/errata/RHSA-2021:3917 |