CVE-2021-33587

NameCVE-2021-33587
DescriptionThe css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs989264

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
node-css-what (PTS)buster, stretch2.1.0-1vulnerable
bullseye, sid4.0.0-3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
node-css-whatsourcestretch(unfixed)end-of-life
node-css-whatsource(unstable)(unfixed)989264

Notes

[bullseye] - node-css-what <ignored> (Minor issue, intrusive to backport fixes to older series)
[buster] - node-css-what <ignored> (Minor issue, intrusive to backport fixes to older series)
[stretch] - node-css-what <end-of-life> (Nodejs in stretch not covered by security support)
https://github.com/fb55/css-what/commit/4cdaacfd0d4b6fd00614be030da0dea6c2994655
https://github.com/fb55/css-what/releases/tag/v5.0.1

Search for package or bug name: Reporting problems