Lucene search
Veracode Vulnerability DatabaseVERACODE:36970HistorySep 08, 2022 - 4:31 a.m.
Regular Expression Denial Of Service (ReDoS)
2022-09-0804:31:41
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
11
mako
vulnerability
regex denial of service
lexer.py
match_tag_start function
application crash
large number
tag quotes
0.002 Low
EPSS
Percentile
60.8%
Mako is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the match attribute in the match_tag_start function of lexer.py, allowing an attacker to crash the application by providing a large number of tag quotes within its quoted sections.
References
github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21
github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c
github.com/sqlalchemy/mako/issues/366
lists.debian.org/debian-lts-announce/2022/09/msg00026.html
pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
pyup.io/vulnerabilities/CVE-2022-40023/50870/
Related
openvas
openvas
Huawei EulerOS: Security Advisory for python-mako (EulerOS-SA-2023-1514)
2023-03-09 00:00:00
Ubuntu: Security Advisory (USN-5625-1)
2022-09-22 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:3979-1)
2022-11-16 00:00:00
oraclelinux
oraclelinux
python-mako security update
2023-05-24 00:00:00
python-mako security update
2023-05-15 00:00:00
amazon
amazon
Medium: python-mako
2023-07-20 17:29:00
osv
osv
Moderate: python-mako security update
2023-05-16 00:00:00
CVE-2022-40023
2022-09-07 13:15:09
mako is vulnerable to Regular Expression Denial of Service
2022-09-16 17:20:25
nessus
nessus
CBL Mariner 2.0 Security Update: python-mako (CVE-2022-40023)
2023-03-28 00:00:00
Oracle Linux 8 : python-mako (ELSA-2023-2893)
2023-05-24 00:00:00
EulerOS Virtualization 3.0.6.6 : python-mako (EulerOS-SA-2023-2416)
2023-07-26 00:00:00
debian
debian
[SECURITY] [DLA 3116-1] mako security update
2022-09-21 16:05:39
redhat
redhat
(RHSA-2023:2258) Moderate: python-mako security update
2023-05-09 05:05:14
(RHSA-2023:2893) Moderate: python-mako security update
2023-05-16 05:57:29
cvelist
cvelist
CVE-2022-40023
2022-09-07 00:00:00
nvd
nvd
CVE-2022-40023
2022-09-07 13:15:09
mageia
mageia
Updated python-mako packages fix security vulnerability
2022-10-01 20:48:24
debiancve
debiancve
CVE-2022-40023
2022-09-07 13:15:09
prion
prion
Design/Logic Flaw
2022-09-07 13:15:00
cbl_mariner
cbl_mariner
CVE-2022-40023 affecting package python-mako for versions less than 1.2.2-1
2022-10-05 23:33:42
CVE-2022-40023 affecting package python-mako 1.0.7-4
2022-10-04 07:51:29
redos
redos
ROS-20230428-02
2023-04-28 00:00:00
ubuntu
ubuntu
Mako vulnerability
2022-11-15 00:00:00
Mako vulnerability
2022-09-21 00:00:00
almalinux
almalinux
Moderate: python-mako security update
2023-05-16 00:00:00
Moderate: python-mako security update
2023-05-09 00:00:00
redhatcve
redhatcve
CVE-2022-40023
2022-09-22 07:49:05
alpinelinux
alpinelinux
CVE-2022-40023
2022-09-07 13:15:09
ubuntucve
ubuntucve
CVE-2022-40023
2022-09-07 00:00:00
github
github
mako is vulnerable to Regular Expression Denial of Service
2022-09-16 17:20:25
cve
cve
CVE-2022-40023
2022-09-07 13:15:09
