Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.
Weakness
The product does not validate, or incorrectly validates, a certificate.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Node-sass | Sass-lang | 2.0.0 (including) | 4.14.1 (including) |
| Node-node-sass | Ubuntu | focal | * |
| Node-node-sass | Ubuntu | groovy | * |
| Node-node-sass | Ubuntu | hirsute | * |
| Node-node-sass | Ubuntu | impish | * |
| Node-node-sass | Ubuntu | kinetic | * |
| Node-node-sass | Ubuntu | lunar | * |
| Node-node-sass | Ubuntu | mantic | * |
| Node-node-sass | Ubuntu | oracular | * |
| Node-node-sass | Ubuntu | plucky | * |
| Node-node-sass | Ubuntu | trusty | * |