GHSA-2p9h-ccw7-33gf

cleo is vulnerable to Regular Expression Denial of Service (ReDoS)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-42966

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	cleo	>= 1.0.0a1, < 2.0.0	2.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-42966 advisory
https://github.com/python-poetry/cleo/pull/285 web
https://github.com/python-poetry/cleo/commit/b5b9a04d2caf58bf7cf94eb7ae4a1ebbe60ea455 web
https://github.com/advisories/GHSA-2p9h-ccw7-33gf advisory
https://github.com/pypa/advisory-database/tree/main/vulns/cleo/PYSEC-2022-43178.yaml web
https://github.com/python-poetry/cleo package
https://github.com/python-poetry/cleo/releases/tag/2.0.0 web
https://research.jfrog.com/vulnerabilities/cleo-redos-xray-257186 web