Description

There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() in eval.cpp. It will lead to a remote denial of service attack.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=1482397

Related Vulnerabilities

CVE-2019-5416 Vulnerability in npm package localhost-now

CVE-2023-30527 Vulnerability in maven package org.jenkins-ci.plugins:wso2id-oauth

CVE-2019-11343 Vulnerability in maven package org.torpedoquery:org.torpedoquery

CVE-2022-45688 Vulnerability in maven package cn.hutool:hutool-json

CVE-2022-22912 Vulnerability in npm package plist

Severity

High

Classification

CWE-674 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Issue Tracking Third Party Advisory