All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\).
**Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.
References
Configurations
History
21 Nov 2024, 07:50
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 3.7 |
| References | () https://github.com/DiffSK/configobj/issues/232 - Issue Tracking | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BO4RLMYEJODCNUE3DJIIUUFVTPAG6VN/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZHY7B33EFY4LESP2NI4APQUPRROTAZK/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYU4IHVLOTYMFPH7KDOJGKZQR4GKWPFK/ - | |
| References | () https://security.snyk.io/vuln/SNYK-PYTHON-CONFIGOBJ-3252494 - Exploit, Third Party Advisory |
03 Nov 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Oct 2023, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file. |
Information
Published : 2023-04-03 05:15
Updated : 2024-11-21 07:50
NVD link : CVE-2023-26112
Mitre link : CVE-2023-26112
CVE.ORG link : CVE-2023-26112
JSON object : View
Products Affected
configobj_project
- configobj
CWE
CWE-1333
Inefficient Regular Expression Complexity