Lucene search
Ubuntu.comUB:CVE-2022-42964HistoryNov 09, 2022 - 12:00 a.m.
CVE-2022-42964
2022-11-0900:00:00
ubuntu.com
ubuntu.com
10
cve-2022-42964; exponential redos; pymatgen package; gaussianinput.from_string method; unix
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
6.5
Confidence
High
EPSS
0.001
Percentile
36.8%
An exponential ReDoS (Regular Expression Denial of Service) can be
triggered in the pymatgen PyPI package, when an attacker is able to supply
arbitrary input to the GaussianInput.from_string method
Bugs
- <https://github.com/materialsproject/pymatgen/issues/2755>
- <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1024017>
Notes
| Author | Note |
|---|---|
| sbeattie | as of 2024-07-17, proposed fix only incorporated in debian, upstream bug report is still open. |
Related
nessus
nessus
cvelist
cvelist
CVE-2022-42964 Exponential ReDoS in pymatgen leads to denial of service
2022-11-09 00:00:00
osv
osv
pymatgen is vulnerable to Regular Expression Denial of Service (ReDoS)
2022-11-10 12:01:17
prion
prion
Design/Logic Flaw
2022-11-09 20:15:00
veracode
veracode
Regular Expression Denial Of Service
2022-11-10 12:06:50
cve
cve
CVE-2022-42964
2022-11-09 20:15:09
debiancve
debiancve
CVE-2022-42964
2022-11-09 20:15:09
freebsd
freebsd
py-pymatgen -- regular expression denial of service
2022-11-10 00:00:00
github
github
pymatgen is vulnerable to Regular Expression Denial of Service (ReDoS)
2022-11-10 12:01:17
nvd
nvd
CVE-2022-42964
2022-11-09 20:15:09
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
6.5
Confidence
High
EPSS
0.001
Percentile
36.8%
Related for UB:CVE-2022-42964