VDB
PYSEC-2022-260
PYSEC-2022-260
PUBLISHED
CVSS 8.699999809265137 HIGH
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
Risk Scores
CVSS 4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | mako | 0, 0, 0.1.1 |
Timeline
- Sep 7, 2022 CVE Published
- Nov 8, 2023 CVE Updated
References
- https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21 url
- https://github.com/advisories/GHSA-v973-fxgf-6xhp advisory
- https://github.com/sqlalchemy/mako/issues/366 discussion
- https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c patch
- https://pyup.io/vulnerabilities/CVE-2022-40023/50870/ url