CVE-2023-44270: Medium severity IBM Data Virtualization on Cloud Pak for Data vulnerability
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
Other sources
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
PostCSS could allow a remote attacker to bypass security restrictions, caused by improper input validaiton. By using a specially crafted external Cascading Style Sheets (CSS), an attacker could exploit this vulnerability to cause \r discrepancies in linters.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability identifier for this issue?
The vulnerability identifier for this issue is CVE-2023-44270.
What is the affected software?
The affected software is PostCSS before 8.4.31.
What is the impact of this vulnerability?
This vulnerability affects linters using PostCSS to parse external Cascading Style Sheets (CSS).
How can I fix this vulnerability?
To fix this vulnerability, upgrade PostCSS to version 8.4.31 or above.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following references: [reference 1](https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25), [reference 2](https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5), [reference 3](https://github.com/postcss/postcss/releases/tag/8.4.31).