[Pkg-javascript-devel] Bug#1032664: mootools: CVE-2021-32821

[Moritz Mühlenhoff]

Source: mootools
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for mootools.

CVE-2021-32821[0]:
| MooTools is a collection of JavaScript utilities for JavaScript
| developers. All known versions include a CSS selector parser that is
| vulnerable to Regular Expression Denial of Service (ReDoS). An attack
| requires that an attacker can inject a string into a CSS selector at
| runtime, which is quite common with e.g. jQuery CSS selectors. No
| patches are available for this issue.

https://securitylab.github.com/advisories/GHSL-2020-345-redos-mootools/

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-32821
    https://www.cve.org/CVERecord?id=CVE-2021-32821

Please adjust the affected versions in the BTS as needed.