Inefficient regular expression complexity in Postcss - CVE-2021-23382
Published: September 4, 2023
Vulnerability identifier: #VU80344
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-23382
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions within the getAnnotationURL() and loadAnnotation() functions in lib/previous-map.js. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
Affected software
Postcss
Splunk Enterprise
IBM Planning Analytics Workspace
IBM Cloud Pak System
QRadar User Behavior Analytics
Splunk Enterprise
IBM Planning Analytics Workspace
IBM Cloud Pak System
QRadar User Behavior Analytics
How to mitigate CVE-2021-23382
Install update from vendor's website.
Postcss - update to 8.2.13
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
IBM Planning Analytics Workspace - update to 2.0.93
IBM Cloud Pak System - update to 2.3.3.5
QRadar User Behavior Analytics - update to 4.1.11
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
IBM Planning Analytics Workspace - update to 2.0.93
IBM Cloud Pak System - update to 2.3.3.5
QRadar User Behavior Analytics - update to 4.1.11