CVE-2020-6817

2023-02-1600:00:00

mozilla

www.cve.org

bleach

redos

regular expression

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.9%

JSON

bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(…, attributes={‘a’: [‘style’]}).

CNA Affected

[
  {
    "vendor": "Mozilla",
    "product": "Mozilla Bleach",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "3.1.4",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]