CVE-2021-29063

Опубликовано: 21 июн. 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.

Ссылки

https://github.com/fredrik-johansson/mpmath/commit/46d44c3c8f3244017fe1eb102d564eb4ab8ef750
Patch
Third Party Advisory
https://github.com/mpmath/mpmath/releases/tag/1.3.0
https://github.com/npm/hosted-git-info/pull/76
Patch
Third Party Advisory
https://github.com/yetingli/PoCs/blob/main/CVE-2021-29063/Mpmath.md
Exploit
Patch
Third Party Advisory
https://github.com/yetingli/SaveResults/blob/main/js/hosted-git-info.js
Not Applicable
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3M5O55E7VUDMXCPQR6MQTOIFDKHP36AA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EIUX3XWY2K3MSO7QXMZXQQYAURARSPC5/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MS2U6GLXQSRZJE2HVUAUMVFR2DWQLCZG/
https://www.npmjs.com/package/hosted-git-info
Product
https://github.com/fredrik-johansson/mpmath/commit/46d44c3c8f3244017fe1eb102d564eb4ab8ef750
Patch
Third Party Advisory
https://github.com/mpmath/mpmath/releases/tag/1.3.0
https://github.com/npm/hosted-git-info/pull/76
Patch
Third Party Advisory
https://github.com/yetingli/PoCs/blob/main/CVE-2021-29063/Mpmath.md
Exploit
Patch
Third Party Advisory
https://github.com/yetingli/SaveResults/blob/main/js/hosted-git-info.js
Not Applicable
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3M5O55E7VUDMXCPQR6MQTOIFDKHP36AA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EIUX3XWY2K3MSO7QXMZXQQYAURARSPC5/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MS2U6GLXQSRZJE2HVUAUMVFR2DWQLCZG/
https://www.npmjs.com/package/hosted-git-info
Product

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mpmath:mpmath:*:*:*:*:*:*:*:*

Версия от 1.0.0 (включая) до 1.2.1 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

EPSS

Процентиль: 84%

0.02352

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-770

Связанные уязвимости

CVE-2021-29063

CVSS3: 7.5

ubuntu

около 4 лет назад

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.

CVE-2021-29063

CVSS3: 7.5

debian

около 4 лет назад

A Regular Expression Denial of Service (ReDOS) vulnerability was disco ...

GHSA-f865-m6cq-j9vx

CVSS3: 7.5

github

около 4 лет назад

ReDOS in Mpmath

BDU:2024-11296

CVSS3: 7.5

fstec

около 4 лет назад

Уязвимость функции mpmathify библиотеки mpmath интерпретатора языка программирования Python, позволяющая нарушителю вызвать отказ в обслуживании (ReDos)

ROS-20250703-06

CVSS3: 7.5

redos

2 месяца назад

Уязвимость python3-mpmath

EPSS

Процентиль: 84%

0.02352

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-770