GHSA-c33w-24p9-8m24

Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-c33w-24p9-8m24/GHSA-c33w-24p9-8m24.json

Aliases

• CVE-2023-26112

Published

2023-04-03T06:30:19Z

Modified

2023-04-11T01:48:23.947967Z

Details

All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)((.*)). Note: This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-26112
• https://github.com/DiffSK/configobj/issues/232
• https://github.com/DiffSK/configobj
• https://security.snyk.io/vuln/SNYK-PYTHON-CONFIGOBJ-3252494