VDB
RHSA-2025%3A0892
RHSA-2025%3A0892
PUBLISHED
CVSS 5.300000190734863 MEDIUM
There's a flaw in the PostCSS package where it fails to properly validate the input CSS, causing commented lines to be interpreted as code. An attacker may leverage that by crafting a CSS file with comments containing CSS code in order to force PostCSS to include the malicious CSS elements in its output. An successful attack may lead to integrity impact as it may inject elements in a web page when parsing untrusted CSS input.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | devspaces/traefik-rhel9@sha256:55275214e27d4620bd2e4caf7a1a24598762fc1eff67c072e9c53fff4a633dca_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | * |
| Red Hat | devspaces/dashboard-rhel9@sha256:70ac5c215c4fc78e0b89c46bfa537f9bfb835af1897708f9cb181648659311d2_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | * |
| Red Hat | devspaces/pluginregistry-rhel9@sha256:c57424174146743c9185105ae51c49e578a9dae1ca53375879a730704a5a686f_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/pluginregistry-rhel9@sha256:c57424174146743c9185105ae51c49e578a9dae1ca53375879a730704a5a686f_ppc64le |
| Red Hat | devspaces/server-rhel9@sha256:03d2025cc1fe797a3c54206cf37323e4bc6bc1c4197b70377bef7f727e33ed1b_s390x as a component of Red Hat OpenShift Dev Spaces 3 | *, *, * |
| Red Hat | devspaces/udi-rhel9@sha256:81e13f10bfa13edbf62318ce58f93f681dc61776e5871e8710e8cf8e0cb86416_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/udi-rhel9@sha256:81e13f10bfa13edbf62318ce58f93f681dc61776e5871e8710e8cf8e0cb86416_ppc64le |
| Red Hat | devspaces/code-rhel9@sha256:90a61893d9127600dd108fedf9ee0b1fcac4502a196b8de7936589c100fc49fe_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | *, *, * |
| Red Hat | devspaces/imagepuller-rhel9@sha256:1aab5a0eeaf68576aa5a0793cbe220bb8a783ec5670aa46240b88530897db345_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | *, *, devspaces/imagepuller-rhel9@sha256:1aab5a0eeaf68576aa5a0793cbe220bb8a783ec5670aa46240b88530897db345_amd64 |
| Red Hat | devspaces/imagepuller-rhel9@sha256:6d121ae6d94afb5d723730e63fcd49c5cfaa1f2518cdb534215399a1f08ff040_s390x as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/imagepuller-rhel9@sha256:6d121ae6d94afb5d723730e63fcd49c5cfaa1f2518cdb534215399a1f08ff040_s390x |
| Red Hat | devspaces/imagepuller-rhel9@sha256:d68cced8fab3fd16ddaaf45fe0c5498b60a4a09a2b5c4e5f984529d041d13708_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | *, *, * |
| Red Hat | devspaces/traefik-rhel9@sha256:55275214e27d4620bd2e4caf7a1a24598762fc1eff67c072e9c53fff4a633dca_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | *, *, * |
| Red Hat | devspaces/devspaces-operator-bundle@sha256:7d585ce8bce9b7ab571bf8a893bda495d255601e14b8a8aa516d0524545748dc_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | * |
| Red Hat | devspaces/devspaces-rhel9-operator@sha256:98f3e811e3c8ebec180a6dc58353f72acf0dffad608b59d091af5f1887d37e05_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/devspaces-rhel9-operator@sha256:98f3e811e3c8ebec180a6dc58353f72acf0dffad608b59d091af5f1887d37e05_ppc64le, * |
| Red Hat | devspaces/udi-rhel9@sha256:81e13f10bfa13edbf62318ce58f93f681dc61776e5871e8710e8cf8e0cb86416_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | *, *, devspaces/udi-rhel9@sha256:81e13f10bfa13edbf62318ce58f93f681dc61776e5871e8710e8cf8e0cb86416_ppc64le |
| Red Hat | devspaces/server-rhel9@sha256:15b8c0c6c6ed150183d8039fda25fa3986a55c8e7571b6d07f19eb91d51ae976_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/server-rhel9@sha256:15b8c0c6c6ed150183d8039fda25fa3986a55c8e7571b6d07f19eb91d51ae976_ppc64le, * |
| Red Hat | devspaces/devspaces-operator-bundle@sha256:6a70f3e63cb4d87e96f54e3f2075a7f8cacaa10c92efe71c4d4bb5a43e4f1247_s390x as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/devspaces-operator-bundle@sha256:6a70f3e63cb4d87e96f54e3f2075a7f8cacaa10c92efe71c4d4bb5a43e4f1247_s390x |
| Red Hat | devspaces/imagepuller-rhel9@sha256:d68cced8fab3fd16ddaaf45fe0c5498b60a4a09a2b5c4e5f984529d041d13708_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | * |
| Red Hat | devspaces/dashboard-rhel9@sha256:92891c316760203637d3739fc7fe5a6801e3b11faf22b405559dc1c05adbf6b2_s390x as a component of Red Hat OpenShift Dev Spaces 3 | *, *, devspaces/dashboard-rhel9@sha256:92891c316760203637d3739fc7fe5a6801e3b11faf22b405559dc1c05adbf6b2_s390x |
| Red Hat | devspaces/pluginregistry-rhel9@sha256:98be37c2d983b7af80f0c8527d6297eaf7177ee52457979b45d13cdd27976004_s390x as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/pluginregistry-rhel9@sha256:98be37c2d983b7af80f0c8527d6297eaf7177ee52457979b45d13cdd27976004_s390x |
| Red Hat | devspaces/configbump-rhel9@sha256:741e2650528085ebfe65969d5c48ab7f3f258d73f0a35e9f0ca0ff2186a64072_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | *, *, * |
…and 50 more
Timeline
- Feb 3, 2025 CVE Published
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- Jul 5, 2026 Distribution Patch
- Jul 5, 2026 Security Advisory
- Jul 5, 2026 Security Advisory
- Jul 19, 2026 CVE Updated
- Jul 19, 2026 Security Advisory
- Jul 19, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2025:0892 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2326998 issue
- https://access.redhat.com/security/cve/CVE-2023-44270 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-44270 advisory
- https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-21538 advisory
- https://pkg.go.dev/vuln/GO-2024-3321 advisory
- https://go.dev/cl/637536 advisory
- https://pkg.go.dev/vuln/GO-2024-3333 advisory
- https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 advisory
- https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc advisory
- https://github.com/pypa/virtualenv/releases/tag/20.26.6 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-55565 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2312631 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2331063 issue
- https://issues.redhat.com/browse/CRW-7648 advisory
- https://github.com/github/advisory-database/issues/2820 advisory
- https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25 advisory
- https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
…and 38 more