An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4003 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4003-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     December 26, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : node-postcss     Version        : 8.2.1+~cs5.3.23-8+deb11u1     CVE ID         : CVE-2021-23566 CVE-2023-44270 CVE-2024-55565     Debian Bug     : 1053282

    Multiple vulnerabilities were fixed in node-postcss a     tool for transforming styles with JS plugins.

    CVE-2021-23566

        nanoid package is vulnerable to Information Exposure via the         valueOf() function which allows to reproduce the last id generated.

    CVE-2023-44270

        The vulnerability affects linters using PostCSS to parse external         untrusted CSS. An attacker can prepare CSS in such a way that it will         contains parts parsed by PostCSS as a CSS comment. After processing         by PostCSS, it will be included in the PostCSS output in CSS nodes         (rules, properties) despite being included in a comment.

    CVE-2024-55565

        nanoid package mishandles non-integer values of size parameter.

    For Debian 11 bullseye, these problems have been fixed in version     8.2.1+~cs5.3.23-8+deb11u1.

    We recommend that you upgrade your node-postcss packages.

    For the detailed security status of node-postcss please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-postcss

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-d335b971e7 advisory.

    New jupyterlab and notebook fixing security vulnerabilities.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-c4377d35e6 advisory.

    New jupyterlab and notebook fixing security vulnerabilities.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213394	Debian dla-4003 : node-postcss - security update	Nessus	Debian Local Security Checks	medium
213072	Fedora 41 : jupyterlab / python-notebook (2024-d335b971e7)	Nessus	Fedora Local Security Checks	medium
213071	Fedora 40 : jupyterlab / python-notebook (2024-c4377d35e6)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2023-44270

medium

Tenable Plugins

medium

medium

medium