GHSA-6v6p-g8cg-2hgg json
Improper Certificate Validation in node-sass affects eZ Platform
published 4y ago modified last yr.
- cvss
- 5.3
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. This affects eZ Platform v2.5 only. The maintainers resolved it by replacing node-sass 4.11 with sass 1.32.13. This issue also affects ezsystems/ezplatform and ezsystems/ezplatform-page-builder.
Patch / fix
- packagist ezsystems/ezplatform-admin-ui 1.5.27
Is GHSA-6v6p-g8cg-2hgg in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | ezsystems/ezplatform-admin-ui | >=1.5.0, <1.5.27 |
1.5.27 |
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
References
-
github.com
/ezsystems/ezplatform-admin-ui/security/advisories/GHSA-6v6p-g8cg-2hgg
web
-
nvd.nist.gov
/vuln/detail/CVE-2020-24025
advisory
-
developers.ibexa.co
/security-advisories/ibexa-sa-2022-002-vulnerability-in-node-sass
web
-
github.com
/advisories/GHSA-r8f7-9pfq-mjmv
advisory
-
github.com
/ezsystems/ezplatform-admin-ui
package
-
github.com
/ezsystems/ezplatform-admin-ui/releases/tag/v1.5.27
web
Sources
- GitHub Advisory GHSA-6v6p-g8cg-2hgg
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.