Description

There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() in eval.cpp. It will lead to a remote denial of service attack.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=1482397

Related Vulnerabilities

CVE-2022-22912 Vulnerability in npm package plist

CVE-2022-37199 Vulnerability in maven package com.jflyfox:jflyfox_jfinal

CVE-2021-3137 Vulnerability in maven package org.xwiki.commons:xwiki-commons

CVE-2019-20444 Vulnerability in maven package io.netty:netty-all

CVE-2022-41940 Vulnerability in npm package engine.io

Severity

High

Classification

CWE-674 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Issue Tracking Third Party Advisory