CVE-2018-19838

{"id": "CVE-2018-19838", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2018-12-04T09:29:00.490", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html", "source": "cve@mitre.org"}, {"url": "https://github.com/sass/libsass/issues/2660", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy()."}, {"lang": "es", "value": "En LibSass, en versiones anteriores a la 3.5.5, las funciones en ast.cpp para la expansi\u00f3n IMPLEMENT_AST_OPERATORS permiten que los atacantes provoquen una denegaci\u00f3n de servicio (DoS) que resulta del consumo de pila mediante un archivo sass manipulado. Esto queda demostrado por llamadas recursivas relacionadas con clone(), cloneChildren() y copy()."}], "lastModified": "2019-07-23T18:15:13.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sass-lang:libsass:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4006729-14F5-408A-8C41-B267A1188EB7", "versionEndExcluding": "3.5.5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}