Skip to content

CVE-2019-6284 Medium Severity Vulnerability detected by WhiteSource聽#34

Open
Open
CVE-2019-6284 Medium Severity Vulnerability detected by WhiteSource#34
Labels
security vulnerabilitySecurity vulnerability detected by WhiteSource

Description

@mend-bolt-for-github
mend-bolt-for-github
bot
opened on Mar 26, 2019

CVE-2019-6284 - Medium Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

馃寛 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

  • /angular4/node_modules/node-sass/src/libsass/src/expand.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/color_maps.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/sass_util.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
  • /angular4/node_modules/node-sass/src/libsass/src/output.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/sass_values.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/util.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/emitter.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/lexer.cpp
  • /angular4/node_modules/node-sass/src/libsass/test/test_node.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/plugins.cpp
  • /angular4/node_modules/node-sass/src/libsass/include/sass/base.h
  • /angular4/node_modules/node-sass/src/libsass/src/position.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/subset_map.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/operation.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/error_handling.hpp
  • /angular4/node_modules/node-sass/src/custom_importer_bridge.cpp
  • /angular4/node_modules/node-sass/src/libsass/contrib/plugin.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/functions.hpp
  • /angular4/node_modules/node-sass/src/libsass/test/test_superselector.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/eval.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/utf8_string.hpp
  • /angular4/node_modules/node-sass/src/sass_context_wrapper.h
  • /angular4/node_modules/node-sass/src/libsass/src/error_handling.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/node.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/parser.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/subset_map.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/emitter.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/listize.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/ast.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/sass_functions.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/output.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/check_nesting.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/functions.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/cssize.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/prelexer.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/paths.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/inspect.hpp
  • /angular4/node_modules/node-sass/src/sass_types/color.cpp
  • /angular4/node_modules/node-sass/src/libsass/test/test_unification.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/values.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/sass_util.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/source_map.hpp
  • /angular4/node_modules/node-sass/src/sass_types/list.h
  • /angular4/node_modules/node-sass/src/libsass/src/check_nesting.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/json.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/units.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/units.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/context.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/utf8/checked.h
  • /angular4/node_modules/node-sass/src/libsass/src/listize.hpp
  • /angular4/node_modules/node-sass/src/sass_types/string.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/prelexer.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/context.hpp
  • /angular4/node_modules/node-sass/src/sass_types/boolean.h
  • /angular4/node_modules/node-sass/src/libsass/include/sass2scss.h
  • /angular4/node_modules/node-sass/src/libsass/src/eval.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/expand.cpp
  • /angular4/node_modules/node-sass/src/sass_types/factory.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/operators.cpp
  • /angular4/node_modules/node-sass/src/sass_types/boolean.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/source_map.cpp
  • /angular4/node_modules/node-sass/src/sass_types/value.h
  • /angular4/node_modules/node-sass/src/libsass/src/utf8_string.cpp
  • /angular4/node_modules/node-sass/src/callback_bridge.h
  • /angular4/node_modules/node-sass/src/libsass/src/file.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/sass.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/node.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/environment.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/extend.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/sass_context.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/operators.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/constants.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/sass.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/parser.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/constants.cpp
  • /angular4/node_modules/node-sass/src/sass_types/list.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/cssize.cpp
  • /angular4/node_modules/node-sass/src/libsass/include/sass/functions.h
  • /angular4/node_modules/node-sass/src/libsass/src/util.cpp
  • /angular4/node_modules/node-sass/src/custom_function_bridge.cpp
  • /angular4/node_modules/node-sass/src/custom_importer_bridge.h
  • /angular4/node_modules/node-sass/src/libsass/src/bind.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/inspect.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/sass_functions.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/backtrace.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/extend.cpp
  • /angular4/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
  • /angular4/node_modules/node-sass/src/libsass/src/debugger.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/cencode.c
  • /angular4/node_modules/node-sass/src/libsass/src/base64vlq.cpp
  • /angular4/node_modules/node-sass/src/sass_types/number.cpp
  • /angular4/node_modules/node-sass/src/sass_types/color.h
  • /angular4/node_modules/node-sass/src/libsass/src/c99func.c
  • /angular4/node_modules/node-sass/src/libsass/src/position.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/sass_values.cpp
  • /angular4/node_modules/node-sass/src/libsass/include/sass/values.h
  • /angular4/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/sass2scss.cpp
  • /angular4/node_modules/node-sass/src/sass_types/null.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/ast.cpp
  • /angular4/node_modules/node-sass/src/libsass/include/sass/context.h
  • /angular4/node_modules/node-sass/src/libsass/src/to_c.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/to_value.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/color_maps.hpp
  • /angular4/node_modules/node-sass/src/sass_context_wrapper.cpp
  • /angular4/node_modules/node-sass/src/libsass/script/test-leaks.pl
  • /angular4/node_modules/node-sass/src/libsass/src/lexer.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/to_c.hpp
  • /angular4/node_modules/node-sass/src/sass_types/map.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/to_value.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/b64/encode.h
  • /angular4/node_modules/node-sass/src/libsass/src/file.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/environment.hpp
  • /angular4/node_modules/node-sass/src/libsass/src/plugins.hpp
  • /angular4/node_modules/node-sass/src/binding.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/sass_context.cpp
  • /angular4/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp.

Publish Date: 2019-01-14

URL: CVE-2019-6284

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    security vulnerabilitySecurity vulnerability detected by WhiteSource

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions