PT-2023-8449 · Pypi+5 · Pygments+5

CVE-2022-40896 · Publicado 2023-07-19 · Atualizado 2026-06-03

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Média

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pygments versions prior to 2.15.0

Description A ReDoS issue was discovered in pygments/lexers/smithy.py via SmithyLexer. The issue is related to the use of a regular expression with inefficient computational complexity. Exploitation of the issue may allow an attacker to cause a denial of service.

Recommendations For Pygments versions prior to 2.15.0, update to version 2.15.0 or later to resolve the issue. As a temporary workaround, consider disabling the SmithyLexer function until a patch is available. Restrict access to the pygments/lexers/smithy.py module to minimize the risk of exploitation.

Exploit

Correção

DoS

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

ALT-PU-2024-14582

ALT-PU-2024-3554

AZL-27502

AZL-35139

BDU:2024-00830

CVE-2022-40896

GHSA-MRWQ-X4V8-FH7P

MGASA-2024-0107

OESA-2023-1477

OESA-2023-1478

OESA-2023-1479

PYSEC-2023-117

RHSA-2024:1057

RHSA-2024:2010

USN-7128-1

Produtos afetados

Alt Linux

Debian

Linuxmint

Pygments

Red Os

Ubuntu

Referências · 51

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/40xxx/CVE-2022-40896.json · Exploit
• 🔥 https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2 · Exploit
• https://github.com/pygments/pygments · Nota
• https://github.com/pygments/pygments/blob/master/pygments/lexers/smithy.py#L61 · Nota
• https://github.com/pygments/pygments/commit/fdf182a7af85b1deeeb637ca970d31935e7c9d52 · Nota
• https://github.com/pygments/pygments/commit/dd52102c38ebe78cd57748e09f38929fd283ad04 · Nota
• https://github.com/pygments/pygments/issues/2356 · Nota
• https://github.com/pygments/pygments/commit/97eb3d5ec7c1b3ea4fcf9dee30a2309cf92bd194 · Nota
• https://github.com/pygments/pygments/issues/2355 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pygments/PYSEC-2023-117.yaml · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZO4BQCIY2S2KZYHERQMKURB7AHXDBO · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-40896 · Aviso do Fabricante
• https://pypi.org/project/Pygments · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-40896 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=33030 · Nota