GHSA-mrwq-x4v8-fh7p
Suggest an improvement- Source
- https://github.com/advisories/GHSA-mrwq-x4v8-fh7p
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-mrwq-x4v8-fh7p/GHSA-mrwq-x4v8-fh7p.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-mrwq-x4v8-fh7p
- Aliases
- Published
- 2023-07-19T15:30:26Z
- Modified
- 2024-10-24T22:07:50.474939Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
- 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Pygments vulnerable to ReDoS
- Details
-
A ReDoS issue was discovered in
pygments/lexers/smithy.pyin Pygments until 2.15.0 via SmithyLexer. - References
-
- https://nvd.nist.gov/vuln/detail/CVE-2022-40896
- https://github.com/pygments/pygments/commit/97eb3d5ec7c1b3ea4fcf9dee30a2309cf92bd194
- https://github.com/pygments/pygments/commit/dd52102c38ebe78cd57748e09f38929fd283ad04
- https://github.com/pygments/pygments/commit/fdf182a7af85b1deeeb637ca970d31935e7c9d52
- https://github.com/pygments/pygments
- https://github.com/pygments/pygments/blob/master/pygments/lexers/smithy.py#L61
- https://github.com/pypa/advisory-database/tree/main/vulns/pygments/PYSEC-2023-117.yaml
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZGMXALE3HSP4OXC7UUWIKX3OXKZDTY3
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZO4BQCIY2S2KZYHERQMKURB7AHXDBO
- https://pypi.org/project/Pygments
- https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2
Affected packages
PyPI / pygments
Package
- Name
- pygments
- View open source insights on deps.dev
- Purl
- pkg:pypi/pygments
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.15.0
Affected versions
0.*
0.5
0.5.1
0.6
0.7
0.7.1
0.8
0.8.1
0.9
0.10
0.11
0.11.1
1.*
1.0
1.1
1.1.1
1.2
1.2.1
1.2.2
1.3
1.3.1
1.4
1.5
1.6rc1
1.6
2.*
2.0rc1
2.0
2.0.1
2.0.2
2.1
2.1.1
2.1.2
2.1.3
2.2.0
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.5.1
2.5.2
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.8.0
2.8.1
2.9.0
2.10.0
2.11.0
2.11.1
2.11.2
2.12.0
2.13.0
2.14.0