GitHub Advisoryadvisory · PyPI
GHSA-v973-fxgf-6xhp mako is vulnerable to Regular Expression Denial of Service
HIGH
Official page ↗
- Aliases
- CVE-2022-40023
- Ecosystem
- PyPI
- Packages
- mako
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1333
- Reviewed
- 2022-09-16
Affected packages
• PyPI mako: < 1.2.2 → fixed in 1.2.2
Description
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
Related
Alias · CVE (1)
- CVE-2022-40023 Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-40023 advisory
- https://github.com/sqlalchemy/mako/issues/366 web
- https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c web
- https://github.com/advisories/GHSA-v973-fxgf-6xhp advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2022-260.yaml web
- https://github.com/sqlalchemy/mako web
- https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21 web
- https://lists.debian.org/debian-lts-announce/2022/09/msg00026.html web
- https://lists.debian.org/debian-lts-announce/2025/12/msg00004.html web
- https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages web
- https://pyup.io/vulnerabilities/CVE-2022-40023/50870 web