CVE-2018-20821: Medium severity libsass vulnerability
LibSass is vulnerable to a denial of service, caused by uncontrolled recursion in Sass::Parser::parsecssvariablevalue in parser.cpp. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause the application to crash.
Other sources
The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parsecssvariablevalue in parser.cpp).
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-20821?
CVE-2018-20821 is a vulnerability in the parsing component of LibSass through version 3.5.5 that allows attackers to cause a denial-of-service through uncontrolled recursion.
What is the affected software?
The affected software is Sass-lang Libsass versions up to and including 3.5.5.
What is the severity of CVE-2018-20821?
The severity of CVE-2018-20821 is medium with a CVSS score of 6.5.
How can attackers exploit CVE-2018-20821?
Attackers can exploit CVE-2018-20821 by triggering uncontrolled recursion in the Sass::Parser::parse_css_variable_value function in parser.cpp.
Is there a fix for CVE-2018-20821?
Yes, upgrading to a version of LibSass beyond 3.5.5 will fix CVE-2018-20821.