GitHub Advisoryadvisory · PyPI
GHSA-2p9h-ccw7-33gf cleo is vulnerable to Regular Expression Denial of Service (ReDoS)
MEDIUM
Official page ↗
- Aliases
- CVE-2022-42966
- Ecosystem
- PyPI
- Packages
- cleo
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1333
- Reviewed
- 2022-11-10
Affected packages
• PyPI cleo: >= 1.0.0a1, < 2.0.0 → fixed in 2.0.0
Description
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method.
Related
Alias · CVE (1)
- CVE-2022-42966 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply… vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-42966 advisory
- https://github.com/python-poetry/cleo/pull/285 web
- https://github.com/python-poetry/cleo/commit/b5b9a04d2caf58bf7cf94eb7ae4a1ebbe60ea455 web
- https://github.com/advisories/GHSA-2p9h-ccw7-33gf advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/cleo/PYSEC-2022-43178.yaml web
- https://github.com/python-poetry/cleo package
- https://github.com/python-poetry/cleo/releases/tag/2.0.0 web
- https://research.jfrog.com/vulnerabilities/cleo-redos-xray-257186 web