Uncontrolled Recursion in LibSass - CVE-2018-20821

Vulnerability identifier: #VU76609

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-20821

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp. A remote attacker can trigger the vulnerability and gain access to potentially sensitive information.

LibSass
IBM Watson Machine Learning Accelerator
IBM Planning Analytics Workspace
IBM Security Verify Information Queue
IBM Edge Application Manager
IBM Watson Machine Learning on CP4D
QRadar User Behavior Analytics
IBM QRadar Data Synchronization App

Install updates from vendor's website.

LibSass - update to 3.6.0
IBM Planning Analytics Workspace - update to 2.0.93
IBM Watson Machine Learning on CP4D - update to 2.6.0
IBM QRadar Data Synchronization App - update to 3.2.1
QRadar User Behavior Analytics - update to 4.1.11
IBM Security Verify Information Queue - update to 10.0.0

• https://github.com/sass/libsass/issues/2658
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html

• Multiple vulnerabilities in IBM Security Verify Information Queue
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM QRadar Data Synchronization App