Description

There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() in eval.cpp. It will lead to a remote denial of service attack.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=1482397

Related Vulnerabilities

CVE-2021-32014 Vulnerability in npm package xlsx

CVE-2020-7772 Vulnerability in npm package doc-path

CVE-2023-48796 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-standalone-server

CVE-2023-5763 Vulnerability in maven package org.glassfish.main.orb:orb-connector

CVE-2022-0084 Vulnerability in maven package org.jboss.xnio:xnio-api

Severity

High

Classification

CWE-674 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Issue Tracking Third Party Advisory