Описание
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| python-cleo | not-affected | package |
Примечания
https://research.jfrog.com/vulnerabilities/cleo-redos-xray-257186/
https://github.com/python-poetry/cleo/issues/284
Introduced with: https://github.com/python-poetry/cleo/commit/de55578da25c6b1736b8b818f21c1bacf7c2475d (1.0.0a1)
Fixed by: https://github.com/python-poetry/cleo/commit/b5b9a04d2caf58bf7cf94eb7ae4a1ebbe60ea455
EPSS
Связанные уязвимости
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method
cleo is vulnerable to Regular Expression Denial of Service (ReDoS)
EPSS