RHEL 7 : python3 (RHSA-2020:3888)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3888 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Regular Expression Denial of Service (ReDoS)

Overview Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. The ReDoS vulnerability ...

FreeBSD : Python -- multiple vulnerabilities (2cb21232-fb32-11ea-a929-a4bf014bf5f7)

Python reports : bpo-39603: Prevent http header injection by rejecting control characters in http.client.putrequest.... bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded CVE-2020-15523. bpo-41004: CVE-2020-14422: The hash methods of ipaddress.IPv4Interface and...

Regular Expression Denial Of Service (ReDoS)

ua-parser-js is vulnerable to regular expression denial of service. A remote attacker is able to cause a denial of service condition by submitting a malicious string that when parsed via the Redmi and Mi Pad regexes, would result in excessive resource consumption...

CVE-2020-7733

The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service ReDoS via the regex for Redmi Phones and Mi Pad Tablets UA...

CVE-2020-7733

CVE-2020-7733 affects ua-parser-js prior to 0.7.22, where the Redmi/Mi UA regex can cause a Regular Expression Denial of Service (ReDoS). This may allow a crafted request to trigger a DoS on affected environments. Remediation: upgrade ua-parser-js to 0.7.22 or newer (as per description). If any d...

CVE-2020-7733: Uncontrolled Resource Consumption

The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service ReDoS via the regex for Redmi Phones and Mi Pad Tablets UA...

Regular Expression Denial Of Service (ReDoS)

pylint is vulnerable to regular expression denial of service. A regex sub-pattern ^\W+\w allows an attacker to cause a denial of service condition using the string ""+"1"5000 + "!"...

@cloudacademy/integrations (>=0.0.2, <=0.0.15), @csnext/cs-data (>=0.0.128-beta.33, <=0.0.128-dev.28) +14 more potentially affected by CVE-2020-36649 via papaparse (>=5.0.0, <=5.1.1)

papaparse NPM version =5.0.0, =0.0.2, =0.0.128-beta.33, =1.5.2-alpha.1, =1.3.5, =0.0.3, =1.0.0, =0.1.0-prerelease.20210117145449, =5.0.0, =2.0.0, =0.1.2, =0.1.0-prerelease.20200903194013, =0.1.0-prerelease.20201214071805, =0.1.7, =1.1.12, =1.1.20 and more Source cves: CVE-2020-36649 Source...

1st_test_yamineo (0.1.0), @akaterra.co/apidog (>=0.0.4, <=0.0.5) +885 more potentially affected by unknown CVE via markdown (>=0.1.2, <=0.5.0)

markdown NPM version =0.1.2, =0.0.4, =0.0.102, =0.1.0, =0.4.0, =0.0.5, =2.1.1, =2.0.0, =0.0.2, =2.1.1, =2.1.1, =2.1.1, =2.1.1, =2.9.14 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WX77-RP39-C6VG...

GHSA-WX77-RP39-C6VG Regular Expression Denial of Service in markdown

All versions of markdown are vulnerable to Regular Expression Denial of Service ReDoS. The markdown.toHTML function has significantly degraded performance when parsing long strings containing underscores. This may lead to Denial of Service if the parser accepts user input. Recommendation No fix i...

GHSA-CH52-VGQ2-943F Regular Expression Denial of Service in marked

Affected versions of marked are vulnerable to Regular Expression Denial of Service ReDoS. The label subrule may significantly degrade parsing performance of malformed input. Recommendation Upgrade to version 0.7.0 or later...

Python -- multiple vulnerabilities

Python reports: bpo-39603: Prevent http header injection by rejecting control characters in http.client.putrequest…. bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded CVE-2020-15523. bpo-41004: CVE-2020-14422: The hash methods of ipaddress.IPv4Interface and...

@21epub/resource-lib (>=1.0.0, <=1.0.3), @2fn/helpers (>=1.0.0, <=1.0.1) +2856 more potentially affected by CVE-2020-15138 via prismjs (>=1.2.0, <=1.20.0)

prismjs NPM version =1.2.0, =1.0.0, =1.0.0, =1.0.23, =1.0.1, =1.2.0, =1.0.0, =1.1.4, =1.16.0, =1.1.2, =0.5.19-20200320212412, =1.0.0-beta.10, =1.0.0-beta.14 - @ada87/hexo-prism-plugin 2.3.0 - @adebawo-damilare/esm-reports-app 5.2.0 - @admin-bro/design-system 1.4.0 and more Source cves:...

Amazon Linux AMI : python27, python34, python35, python36 (ALAS-2020-1407)

The version of python27 installed on the remote host is prior to 2.7.18-1.138. The version of python34 installed on the remote host is prior to 3.4.10-1.50. The version of python35 installed on the remote host is prior to 3.5.7-1.26. The version of python36 installed on the remote host is prior t...

Medium: python26

Issue Overview: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic...

Regular Expression Denial Of Service (ReDoS)

wicket is vulnerable to regular expression denial of service ReDoS attacks. The vulnerability is possible due to improper usage of regular expression in trimParens field, allowing a malicious user to crash the application by passing malicious strings...

npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser

websocket-extensions npm module prior to 0.1.4 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other...

Node.js third-party modules: [is-my-json-valid] ReDoS via 'style' format

I would like to report a ReDoS in is-my-json-valid It allows cause a denial of service if schema uses the built-in style format. Module module name: is-my-json-valid version: 2.20.1 npm page: https://www.npmjs.com/package/is-my-json-valid Module Description A JSONSchema validator that uses code...

Denial of Service in gajus/url-regexp

Overview RegExp object to match and validate URLs. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. An attacker providing a long URL to validate or replace function will cause a Denial of Service attack. PoC node var regex = require"url-regexp";...