-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0 #45
Labels
security vulnerability
Security vulnerability detected by WhiteSource
Comments
mend-bolt-for-github
bot
added
the
security vulnerability
Security vulnerability detected by WhiteSource
label
Nov 2, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
Nov 3, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
Nov 4, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
Nov 6, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
Nov 6, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
Nov 6, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
Nov 6, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
Nov 8, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
Nov 8, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
Nov 8, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
Nov 8, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
Nov 8, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
Nov 9, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
Nov 9, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
Nov 9, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
Nov 10, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
Nov 10, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
Nov 10, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
Nov 10, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
Dec 1, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
Dec 1, 2020
mend-bolt-for-github
bot
changed the title
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11
CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.6.0
Dec 3, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
CVE-2018-19839 - Medium Severity Vulnerability
Vulnerable Libraries - node-sass-4.14.1.tgz, CSS::Sassv3.6.0
node-sass-4.14.1.tgz
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz
Path to dependency file: resume/package.json
Path to vulnerable library: resume/node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: 5f3662aa801596074e7b1252738e340f55c2c760
Vulnerability Details
In LibSass prior to 3.5.5, the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file.
Publish Date: 2018-12-04
URL: CVE-2018-19839
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19839
Release Date: 2018-12-04
Fix Resolution: Libsass:3.6.0
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: