ReDos vulnerability on guest checkout email validation

Impact Denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential backtracking through a fragment like a.a.. Before the patch, it can be reproduced in the console like this: ruby irbmain...

PT-2021-24154 · Calibre · Calibre

Name of the Vulnerable Software and Affected Versions: calibre versions prior to 5.32.0 Description: The issue is related to a regular expression in html preprocess rules within the ebooks/conversion/preprocess.py file that is vulnerable to ReDoS Regular Expression Denial of Service. This could...

openSUSE 15 Security Update : python-Pygments (openSUSE-SU-2021:1521-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1521-1 advisory. - In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular...

mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover

A Cross-Site Request Forgery CSRF attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right type of user when performing admin operations and a token created by a regular user can be used by an admin to perform an admin-level request, effectively...

mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover

A Cross-Site Request Forgery CSRF attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right type of user when performing admin operations and a token created by a regular user can be used by an admin to perform an admin-level request, effectively...

openSUSE 15 Security Update : python-sqlparse (openSUSE-SU-2021:3857-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:3857-1 advisory. - sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in...

openSUSE: Security Advisory for python-sqlparse (openSUSE-SU-2021:3857-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE 15 Security Update : python-Pygments (openSUSE-SU-2021:3839-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:3839-1 advisory. - In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular...

SUSE SLED15 / SLES15 Security Update : python-sqlparse (SUSE-SU-2021:3857-1)

The remote SUSE Linux SLED15 / SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:3857-1 advisory. - CVE-2021-32839: Fixed ReDoS via regular expression in StripComments filter bsc1190741. Tenable has extracted the preceding description block...

Security update for python-sqlparse (moderate)

openSUSE Security Update: Security update for python-sqlparse Announcement ID: openSUSE-SU-2021:3857-1 Rating: moderate References: 1190741 Cross-References: CVE-2021-32839 CVSS scores: CVE-2021-32839 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-32839 SUSE: 6.5...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Axios

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Axios. Vulnerability Details CVEID: CVE-2021-3749 DESCRIPTION: axios is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the trim function. By sending a...

SUSE SLES12 Security Update : python-Pygments (SUSE-SU-2021:3814-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:3814-1 advisory. - CVE-2021-27291: Fixed ReDoS via crafted malicious input bsc1184812. Tenable has extracted the preceding description block directly from the SUSE...

ReDoS in LDAP schema parser

https://github.com/python-ldap/python-ldap/issues/424 Impact The LDAP schema parser of python-ldap 3.3.1 and earlier are vulnerable to a regular expression denial-of-service attack. The issue affects clients that use ldap.schema package to parse LDAP schema definitions from an untrusted source...

PT-2021-24339

Name of the Vulnerable Software and Affected Versions: python-ldap versions prior to 3.4.0 Description: The issue is related to a regular expression denial of service ReDoS flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this...

Regular Expression Denial Of Service (ReDoS)

ramda is vulnerable to regular expression denial of service. The trim function in ramda.js does not properly replace the user input strings due to the insufficient regex pattern used for the ws field, allowing a malicious user to crash the application by providing a malicious input...

Whispers - Identify Hardcoded Secrets In Static Structured Text

"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord Varys Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can...

GHSA-XX4C-JJ58-R7X6 Inefficient Regular Expression Complexity in Validator.js

Impact Versions of validator prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using the rtrim and trim sanitizers. Patches The problem has been patched in validator 13.7.0...

Inefficient Regular Expression Complexity in Validator.js

Impact Versions of validator prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using the rtrim and trim sanitizers. Patches The problem has been patched in validator 13.7.0...

Internet Bug Bounty: Ruby - Regular Expression Denial of Service Vulnerability of Date Parsing Methods

Official report: https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/ CVE-2021-41817 Here are the details from the official article: Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular...

Oracle Linux 8 : resource-agents (ELSA-2021-9553)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-9553 advisory. - python-pygments: fix CVE-2021-27291 and CVE-2021-20270 Resolves: rhbz1872754, rhbz1934651, rhbz1935422, rhbz1943464 Tenable has extracted the precedi...