CVE-2022-40896

Опубликовано: 26 нояб. 2023

Источник: redhat

CVSS3: 5.5

Описание

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

A denial-of-service vulnerability related to regular expressions was discovered in Pygments, specifically in the file pygments/lexers/smithy.py. An attacker could exploit this flaw by sending a carefully crafted request, leading to a denial-of-service situation.

Отчет

https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2/ https://data.safetycli.com/vulnerabilities/CVE-2022-40896/58910/?utm_source=pyupio&utm_medium=redirect&utm_campaign=pyup_rd&utm_id=0817&utm_content=data

Меры по смягчению последствий

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Затронутые пакеты

Платформа	Пакет	Состояние
Red Hat Ansible Automation Platform 2	aap-cloud-metrics-collector-container	Will not fix
Red Hat Ansible Automation Platform 2	ansible-automation-platform-24/ansible-builder-rhel9	Not affected
Red Hat Ansible Automation Platform 2	ansible-automation-platform-24/de-supported-rhel8	Not affected
Red Hat Ansible Automation Platform 2	ansible-automation-platform-24/ee-dellemc-openmanage-rhel8	Not affected
Red Hat Ansible Automation Platform 2	ansible-automation-platform-24/ee-minimal-rhel8	Not affected
Red Hat Ansible Automation Platform 2	ansible-automation-platform-25/ee-cloud-services-rhel9	Not affected
Red Hat Ansible Automation Platform 2	ansible-automation-platform-25/platform-resource-runner-rhel8	Not affected
Red Hat Ansible Automation Platform 2	ansible-lint	Not affected
Red Hat Ansible Automation Platform 2	ansible-navigator	Not affected
Red Hat Ansible Automation Platform 2	python3x-ansible-compat	Not affected

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Moderate

Дефект:

CWE-434

https://bugzilla.redhat.com/show_bug.cgi?id=2251643pygments: ReDoS in pygments

5.5 Medium

CVSS3

Связанные уязвимости

CVE-2022-40896

CVSS3: 5.5

ubuntu

больше 2 лет назад

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

CVE-2022-40896

CVSS3: 5.5

nvd

больше 2 лет назад

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

CVE-2022-40896

CVSS3: 5.5

msrc

6 месяцев назад

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

CVE-2022-40896

CVSS3: 5.5

debian

больше 2 лет назад

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments ...

GHSA-mrwq-x4v8-fh7p

CVSS3: 5.5

github

больше 2 лет назад

Pygments vulnerable to ReDoS

5.5 Medium

CVSS3