The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear     Time Complexity relative to the size of the input. (CVE-2021-33587)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear
    Time Complexity relative to the size of the input. (CVE-2021-33587)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0613 advisory.

  - A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as     @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states we are in     the process of marking this report as invalid; however, some third parties takes the position that A     prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge     or deep cloning but also when a target object is polluted. (CVE-2022-37616)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

  - An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

  - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.
    X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME     incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently     interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL     checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may     allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or     enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate     chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these     inputs, the other input must already contain an X.400 address as a CRL distribution point, which is     uncommon. As such, this vulnerability is most likely to only affect applications which have implemented     their own functionality for retrieving CRLs over a network. (CVE-2023-0286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6065-1 advisory.

    It was discovered that css-what incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     cause a denial of service. (CVE-2021-33587, CVE-2022-21222)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3350 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3350-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Bastien Roucaries     March 03, 2023                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : node-css-what     Version        : 2.1.0-1     CVE ID         : CVE-2022-21222 CVE-2021-33587     Debian Bug     : #1032188

    node-css-what was vulnerable to Regular Expression Denial of Service     (ReDoS) due to the usage of insecure regular expression in the     re_attr variable.
    The exploitation of this vulnerability could be triggered     via the parse function.

    For Debian 10 buster, this problem has been fixed in version     2.1.0-1+deb10u1.

    We recommend that you upgrade your node-css-what packages.

    For the detailed security status of node-css-what please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-css-what

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
250859	Linux Distros Unpatched Vulnerability : CVE-2021-33587	Nessus	Misc.	Local	high
418002	SCA: security update for css-what (GHSA-q8pj-2vqx-8ggc)	Tenable Cloud Security	SCA Checks	Local	high
418002	SCA: security update for css-what (GHSA-q8pj-2vqx-8ggc)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
194919	Splunk Enterprise < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	Combined	critical
175560	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 ESM : css-what vulnerabilities (USN-6065-1)	Nessus	Ubuntu Local Security Checks	Local	high
172087	Debian dla-3350 : node-css-what - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2021-33587

high

Tenable Plugins

high

high

high

critical

high

high