Resource exhaustion in LibSass - CVE-2018-20822
Published: April 23, 2019 / Updated: August 8, 2020
Vulnerability identifier: #VU35977
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-20822
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
LibSass 3.5.4 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp).
Affected software
LibSass
IBM Watson Machine Learning Accelerator
IBM Security Verify Information Queue
IBM Watson Machine Learning on CP4D
IBM Watson Machine Learning Accelerator
IBM Security Verify Information Queue
IBM Watson Machine Learning on CP4D
How to mitigate CVE-2018-20822
Install update from vendor's website.
IBM Watson Machine Learning on CP4D - update to 2.6.0
IBM Security Verify Information Queue - update to 10.0.0
IBM Security Verify Information Queue - update to 10.0.0