CVE-2022-43357 - Vulnerability Details - OpenCVE

Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by attackers to causea denial of service (DoS). Also affects the command line driver for libsass, sassc 3.6.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Sass-lang	Libsass Sassc

Configuration 1 [-]

OR	cpe:2.3:a:sass-lang:libsass:3.6.5-8-g210218:::::::*
	cpe:2.3:a:sass-lang:sassc:3.6.2:::::::*

No data.

References

Link	Providers
https://drive.google.com/file/d/1aC5q3czen0atI91fuBIoCBFkS30_OSWX/
https://github.com/sass/libsass
https://github.com/sass/libsass/issues/3177

History

Thu, 03 Oct 2024 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-08-22T00:00:00

Updated: 2024-10-03T14:35:50.380Z

Reserved: 2022-10-17T00:00:00

Link: CVE-2022-43357

Vulnrichment

Updated: 2024-08-03T13:26:02.982Z

NVD

Status : Modified

Published: 2023-08-22T19:16:29.527

Modified: 2024-11-21T07:26:19.753

Link: CVE-2022-43357

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sass-lang:libsass:3.6.5-8-g210218:*:*:*:*:*:*:*", "matchCriteriaId": "DD554F0E-70F8-4860-8F1A-292E60E0F9A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:sass-lang:sassc:3.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "5701EB35-B580-49A4-9BB2-575049483A38", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by attackers to causea denial of service (DoS). Also affects the command line driver for libsass, sassc 3.6.2."}, {"lang": "es", "value": "Vulnerabilidad de desbordamiento de pila en ast_selectors.cpp en la funci\u00f3n Sass::CompoundSelector::has_real_parent_ref en libsass:3.6.5-8-g210218, que puede ser explotada por atacantes para causar una denegaci\u00f3n de servicio (DoS). Tambi\u00e9n afecta al controlador de l\u00ednea de comandos para libsass, sassc 3.6.2."}], "id": "CVE-2022-43357", "lastModified": "2024-11-21T07:26:19.753", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-08-22T19:16:29.527", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Permissions Required", "Third Party Advisory"], "url": "https://drive.google.com/file/d/1aC5q3czen0atI91fuBIoCBFkS30_OSWX/"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/sass/libsass"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/sass/libsass/issues/3177"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Permissions Required", "Third Party Advisory"], "url": "https://drive.google.com/file/d/1aC5q3czen0atI91fuBIoCBFkS30_OSWX/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://github.com/sass/libsass"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/sass/libsass/issues/3177"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}