GHSA-c33w-24p9-8m24

configobj ReDoS exploitable by developer using values in a server-side configuration file

Source: GitHub Advisory Database (reviewed) Low CVE-2023-26112

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	configobj	< 5.0.9	5.0.9

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-26112 advisory
https://github.com/DiffSK/configobj/issues/232 web
https://github.com/DiffSK/configobj/commit/7c618b0bbaff6ecaca51a6f05b29795d1377a4a5 web
https://github.com/DiffSK/configobj package
https://lists.fedoraproject.org/archives/list/[email protected]/message/6BO4RLMYEJODCNUE3DJIIUUFVTPAG6VN web
https://lists.fedoraproject.org/archives/list/[email protected]/message/NZHY7B33EFY4LESP2NI4APQUPRROTAZK web
https://lists.fedoraproject.org/archives/list/[email protected]/message/PYU4IHVLOTYMFPH7KDOJGKZQR4GKWPFK web
https://pypi.org/project/configobj/5.0.9 web
https://security.snyk.io/vuln/SNYK-PYTHON-CONFIGOBJ-3252494 web