GHSA-pq64-v7f5-gqh8
Vulnerability from github
Published
2021-03-29 16:33
Modified
2024-10-14 16:10
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Summary
Pygments vulnerable to Regular Expression Denial of Service (ReDoS)
Details
In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "Pygments" }, "ranges": [ { "events": [ { "introduced": "1.1" }, { "fixed": "2.7.4" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2021-27291" ], "database_specific": { "cwe_ids": [ "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2021-03-22T20:28:40Z", "nvd_published_at": "2021-03-17T13:15:00Z", "severity": "HIGH" }, "details": "In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.", "id": "GHSA-pq64-v7f5-gqh8", "modified": "2024-10-14T16:10:54Z", "published": "2021-03-29T16:33:03Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27291" }, { "type": "WEB", "url": "https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14" }, { "type": "WEB", "url": "https://gist.github.com/b-c-ds/b1a2cc0c68a35c57188575eb496de5ce" }, { "type": "PACKAGE", "url": "https://github.com/pygments/pygments" }, { "type": "WEB", "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pygments/PYSEC-2021-141.yaml" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00024.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSJRFHALQ7E3UV4FFMFU2YQ6LUDHAI55" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSLD67LFGXOX2K5YNESSWAS4AGZIJTUQ" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-4878" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-4889" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "Pygments vulnerable to Regular Expression Denial of Service (ReDoS)" }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.