CVE-2021-33587 (High) detected in css-what-2.1.3.tgz, css-what-4.0.0.tgz - autoclosed
Closed this issue · 2 comments
CVE-2021-33587 - High Severity Vulnerability
Vulnerable Libraries - css-what-2.1.3.tgz, css-what-4.0.0.tgz
css-what-2.1.3.tgz
a CSS selector parser
Library home page: https://registry.npmjs.org/css-what/-/css-what-2.1.3.tgz
Path to dependency file: Google-api-python-client/package.json
Path to vulnerable library: Google-api-python-client/node_modules/css-what/package.json
Dependency Hierarchy:
- website-scraper-4.2.3.tgz (Root Library)
- cheerio-0.22.0.tgz
- css-select-1.2.0.tgz
- ❌ css-what-2.1.3.tgz (Vulnerable Library)
- css-select-1.2.0.tgz
- cheerio-0.22.0.tgz
css-what-4.0.0.tgz
a CSS selector parser
Library home page: https://registry.npmjs.org/css-what/-/css-what-4.0.0.tgz
Path to dependency file: Google-api-python-client/package.json
Path to vulnerable library: Google-api-python-client/node_modules/cheerio-select-tmp/node_modules/css-what/package.json
Dependency Hierarchy:
- cheerio-1.0.0-rc.5.tgz (Root Library)
- cheerio-select-tmp-0.1.1.tgz
- ❌ css-what-4.0.0.tgz (Vulnerable Library)
- cheerio-select-tmp-0.1.1.tgz
Found in HEAD commit: f8f03aed50596222443692cbf2b69e91a97207ae
Found in base branch: main
Vulnerability Details
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
Publish Date: 2021-05-28
URL: CVE-2021-33587
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587
Release Date: 2021-05-28
Fix Resolution: css-what - 5.0.1
Step up your Open Source Security Game with WhiteSource here
ℹ️ This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #224
ℹ️ This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #224