PYSEC-2021-20

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/markdown2/PYSEC-2021-20.yaml

JSON Data

https://api.test.osv.dev/v1/vulns/PYSEC-2021-20

Aliases

Published

2021-03-03T16:15:00Z

Modified

2023-11-01T04:54:52.330522Z

Summary

[none]

Details

markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.

References

Affected packages

PyPI / markdown2

Package

Name: markdown2; View open source insights on deps.dev
Purl: pkg:pypi/markdown2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.1.18

Fixed

2.4.0

Affected versions

1.*

1.0.1.18

1.0.1.19

1.1.0

1.1.1

1.2.0

1.3.0

1.3.1

1.4.0

1.4.1

1.4.2

2.*

2.0.0

2.0.1

2.1.0

2.2.0

2.2.1

2.2.2

2.2.3

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.3.10

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/markdown2/PYSEC-2021-20.yaml"