Lucene search

K

Veracode Vulnerability DatabaseVERACODE:40092

HistoryApr 10, 2023 - 9:02 a.m.

Regular Expression Denial Of Service (ReDoS)

2023-04-1009:02:02

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

12

regular expression dos

software vulnerability

inefficient regex complexity

EPSS

0.001

Percentile

50.0%

configobj is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability is due to inefficent regex complexity via the validate function, which can lead to a Denial of Service if an attacker is able to control the input being parsed.

References

github.com/DiffSK/configobj/blob/v5.0.8/src/configobj/validate.py#L660

github.com/DiffSK/configobj/issues/232

lists.fedoraproject.org/archives/list/[email protected]/message/6BO4RLMYEJODCNUE3DJIIUUFVTPAG6VN/

lists.fedoraproject.org/archives/list/[email protected]/message/NZHY7B33EFY4LESP2NI4APQUPRROTAZK/

lists.fedoraproject.org/archives/list/[email protected]/message/PYU4IHVLOTYMFPH7KDOJGKZQR4GKWPFK/

EPSS

0.001

Percentile

50.0%

Related for VERACODE:40092

openvas16 prion1 nessus24 cvelist1 osv3 freebsd2 cve1 fedora3 github1 ibm1 ubuntucve1 amazon1 redhatcve1 redos1 debiancve1 nvd1