CVE-2022-40023

Опубликовано: 07 сент. 2022

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

Ссылки

https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21
Exploit
Third Party Advisory
https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c
Patch
https://github.com/sqlalchemy/mako/issues/366
Issue Tracking
Patch
https://lists.debian.org/debian-lts-announce/2022/09/msg00026.html
Mailing List
Third Party Advisory
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
Exploit
Third Party Advisory
https://pyup.io/vulnerabilities/CVE-2022-40023/50870/
Third Party Advisory
https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21
Exploit
Third Party Advisory
https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c
Patch
https://github.com/sqlalchemy/mako/issues/366
Issue Tracking
Patch
https://lists.debian.org/debian-lts-announce/2022/09/msg00026.html
Mailing List
Third Party Advisory
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
Exploit
Third Party Advisory
https://pyup.io/vulnerabilities/CVE-2022-40023/50870/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sqlalchemy:mako:*:*:*:*:*:*:*:*

Версия до 1.2.2 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 69%

0.00607

Низкий

7.5 High

CVSS3

Дефекты

CWE-1333

Связанные уязвимости

CVE-2022-40023

CVSS3: 7.5

ubuntu

около 3 лет назад

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

CVE-2022-40023

CVSS3: 7.5

redhat

около 3 лет назад

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

CVE-2022-40023

CVSS3: 7.5

msrc

около 3 лет назад

Описание отсутствует

CVE-2022-40023

CVSS3: 7.5

debian

около 3 лет назад

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denia ...

SUSE-SU-2022:3979-1

suse-cvrf

почти 3 года назад

Security update for python-Mako

EPSS

Процентиль: 69%

0.00607

Низкий

7.5 High

CVSS3

Дефекты

CWE-1333