Bug 2114794 (CVE-2022-25758) - CVE-2022-25758 scss-tokenizer: Regular expression denial of service in scss-tokenizer
Summary: CVE-2022-25758 scss-tokenizer: Regular expression denial of service in scss-t...
Keywords:
Status: NEW
Alias: CVE-2022-25758
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2114795 2114797 2114798 2114799 2114800 2114801 2114802 2114803 2114804 2114811 2114812 2114813 2115670 2115671 2115672 2115673 2115674 2115675 2116909
Blocks: 2103716
TreeView+ depends on / blocked
 
Reported: 2022-08-03 09:51 UTC by Avinash Hanwate
Modified: 2023-10-25 17:21 UTC (History)
59 users (show)

Fixed In Version: scss-tokenizer 0.4.3
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the scss-tokenizer package. Affected versions of this package are vulnerable to a regular expression denial of service (ReDoS) attacks.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Avinash Hanwate 2022-08-03 09:51:10 UTC 
All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2936782
https://snyk.io/vuln/SNYK-JS-SCSSTOKENIZER-2339884
https://github.com/sasstools/scss-tokenizer/issues/45
Comment 1 Avinash Hanwate 2022-08-03 09:51:35 UTC 
Created gnome-shell-extension-material-shell tracking bugs for this issue:

Affects: fedora-all [bug 2114795]
Comment 11 Przemyslaw Roguski 2022-09-14 13:42:52 UTC 
In the comment 0 there is an incorrect link to upstream issue.
https://github.com/sasstools/scss-tokenizer/issues/45 is related to previous CVE-2021-23382

The correct upstream issue for the CVE-2022-25758 is:
https://github.com/sasstools/scss-tokenizer/issues/48
Upstream fix is: https://github.com/sasstools/scss-tokenizer/pull/49
Note You need to log in before you can comment on or make changes to this bug.