GitHub Advisoryadvisory · PyPI

GHSA-c33w-24p9-8m24 configobj ReDoS exploitable by developer using values in a server-side configuration file

LOW Published 2023-04-03 Modified 2024-12-16 Official page ↗
Aliases
CVE-2023-26112
Ecosystem
PyPI
Packages
configobj
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1333
Reviewed
2023-04-04

Affected packages

• PyPI configobj: < 5.0.9 → fixed in 5.0.9

Description

All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). Note: This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.

Related

Alias · CVE (1)

  • CVE-2023-26112 All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References