Regular Expression Denial of Service (ReDoS)

Overview Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. The ReDoS vulnerability ...

FreeBSD : Python -- multiple vulnerabilities (2cb21232-fb32-11ea-a929-a4bf014bf5f7)

Python reports : bpo-39603: Prevent http header injection by rejecting control characters in http.client.putrequest.... bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded CVE-2020-15523. bpo-41004: CVE-2020-14422: The hash methods of ipaddress.IPv4Interface and...

Regular Expression Denial Of Service (ReDoS)

ua-parser-js is vulnerable to regular expression denial of service. A remote attacker is able to cause a denial of service condition by submitting a malicious string that when parsed via the Redmi and Mi Pad regexes, would result in excessive resource consumption...

CVE-2020-7733

The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service ReDoS via the regex for Redmi Phones and Mi Pad Tablets UA...

CVE-2020-7733

The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service ReDoS via the regex for Redmi Phones and Mi Pad Tablets UA...

CVE-2020-7733

CVE-2020-7733 affects ua-parser-js prior to 0.7.22, where the Redmi/Mi UA regex can cause a Regular Expression Denial of Service (ReDoS). This may allow a crafted request to trigger a DoS on affected environments. Remediation: upgrade ua-parser-js to 0.7.22 or newer (as per description). If any d...

CVE-2020-7733: Uncontrolled Resource Consumption

The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service ReDoS via the regex for Redmi Phones and Mi Pad Tablets UA...

Regular Expression Denial Of Service (ReDoS)

pylint is vulnerable to regular expression denial of service. A regex sub-pattern ^\W+\w allows an attacker to cause a denial of service condition using the string ""+"1"5000 + "!"...

@cloudacademy/integrations (>=0.0.2, <=0.0.15), @csnext/cs-data (>=0.0.128-beta.33, <=0.0.128-dev.28) +14 more potentially affected by CVE-2020-36649 via papaparse (>=5.0.0, <=5.1.1)

papaparse NPM version =5.0.0, =0.0.2, =0.0.128-beta.33, =1.5.2-alpha.1, =1.3.5, =0.0.3, =1.0.0, =0.1.0-prerelease.20210117145449, =5.0.0, =2.0.0, =0.1.2, =0.1.0-prerelease.20200903194013, =0.1.0-prerelease.20201214071805, =0.1.7, =1.1.12, =1.1.20 and more Source cves: CVE-2020-36649 Source...

1st_test_yamineo (0.1.0), @akaterra.co/apidog (>=0.0.4, <=0.0.5) +884 more potentially affected by unknown CVE via markdown (>=0.1.2, <=0.5.0)

markdown NPM version =0.1.2, =0.0.4, =0.0.102, =0.1.0, =0.4.0, =0.0.5, =2.1.1, =2.0.0, =0.0.2, =2.1.1, =2.1.1, =2.1.1, =2.1.1, =2.9.14 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WX77-RP39-C6VG...

GHSA-WX77-RP39-C6VG Regular Expression Denial of Service in markdown

All versions of markdown are vulnerable to Regular Expression Denial of Service ReDoS. The markdown.toHTML function has significantly degraded performance when parsing long strings containing underscores. This may lead to Denial of Service if the parser accepts user input. Recommendation No fix i...

GHSA-CH52-VGQ2-943F Regular Expression Denial of Service in marked

Affected versions of marked are vulnerable to Regular Expression Denial of Service ReDoS. The label subrule may significantly degrade parsing performance of malformed input. Recommendation Upgrade to version 0.7.0 or later...

PT-2020-21035

Name of the Vulnerable Software and Affected Versions simple-markdown versions prior to 0.5.2 Description The issue concerns a Regular Expression Denial of Service ReDoS that affects the performance of the SimpleMarkdown.defaultInlineParse function when parsing inline code blocks. Recommendations...

PT-2020-21239

Name of the Vulnerable Software and Affected Versions marked versions prior to 0.7.0 Description The issue concerns a Regular Expression Denial of Service ReDoS in the label subrule, which can significantly degrade parsing performance when given malformed input. Recommendations Upgrade to version...

Python -- multiple vulnerabilities

Python reports: bpo-39603: Prevent http header injection by rejecting control characters in http.client.putrequest…. bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded CVE-2020-15523. bpo-41004: CVE-2020-14422: The hash methods of ipaddress.IPv4Interface and...

@21epub/resource-lib (>=1.0.0, <=1.0.3), @2fn/helpers (>=1.0.0, <=1.0.1) +2852 more potentially affected by CVE-2020-15138 via prismjs (>=1.2.0, <=1.20.0)

prismjs NPM version =1.2.0, =1.0.0, =1.0.0, =1.0.23, =1.0.1, =1.2.0, =1.0.0, =1.1.4, =1.16.0, =1.1.2, =0.5.19-20200320212412, =1.0.0-beta.10, =1.0.0-beta.14 - @adebawo-damilare/esm-reports-app 5.2.0 - @admin-bro/design-system 1.4.0 - @afzalh/aug07 1.1.2 and more Source cves: CVE-2020-15138 Source...

Amazon Linux AMI : python27, python34, python35, python36 (ALAS-2020-1407)

The version of python27 installed on the remote host is prior to 2.7.18-1.138. The version of python34 installed on the remote host is prior to 3.4.10-1.50. The version of python35 installed on the remote host is prior to 3.5.7-1.26. The version of python36 installed on the remote host is prior t...

Medium: python26

Issue Overview: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic...

Regular Expression Denial Of Service (ReDoS)

wicket is vulnerable to regular expression denial of service ReDoS attacks. The vulnerability is possible due to improper usage of regular expression in trimParens field, allowing a malicious user to crash the application by passing malicious strings...

npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser

websocket-extensions npm module prior to 0.1.4 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other...