Description
Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.
Remediation
References
https://github.com/sass/node-sass/pull/567#issuecomment-656609236
Related Vulnerabilities
CVE-2017-2670 Vulnerability in maven package io.undertow:undertow-core
CVE-2019-1003049 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2021-32809 Vulnerability in maven package org.webjars.bowergithub.ckeditor:ckeditor4
CVE-2020-2161 Vulnerability in maven package org.jenkins-ci.main:jenkins-core