PT-2023-9395 · Configobj+5 · Configobj+5
Darktinia
·
Publicado
2023-04-03
·
Atualizado
2024-10-14
·
CVE-2023-26112
CVSS v2.0
5.4
Média
| Vetor | AV:N/AC:H/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
configobj versions all versions
Description
The issue is related to the use of a regular expression with inefficient computational complexity in the configobj package. This can be exploited to cause a denial of service. The
validate function is vulnerable to Regular Expression Denial of Service (ReDoS) via the use of (.+?)((.*)). This is only exploitable in the case of a developer putting the offending value in a server-side configuration file.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Debian
Linuxmint
Red Os
Suse
Ubuntu
Configobj