Os-Ws

**Name of the Vulnerable Software and Affected Versions** Mpmath versions 1.0.0 through 1.2.1 **Description** A Regular Expression Denial of Service (ReDOS) issue is present in the mpmathify function of the Mpmath library for Python. This issue can be exploited by a remote attacker to cause a denial of service. The `mpmathify` function is the vulnerable component. No information is provided about the estimated number of potentially affected devices or real-world incidents. **Recommendations** For Mpmath versions 1.0.0 through 1.2.1, consider disabling the `mpmathify` function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dio package versions prior to 5.0.0 **Description** The issue allows CRLF injection if the attacker controls the HTTP method string. This is a different issue than previously identified problems. **Recommendations** For dio package versions prior to 5.0.0, update to version 5.0.0 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: node-sass versions 2.0.0 through 6.0.1 Description: The issue is related to disabled certificate validation in node-sass when requesting binaries, even if the user does not specify an alternative download path. This affects certain versions of eZ Platform, ezsystems/ezplatform, and ezsystems/ezplatform-page-builder. The maintainers resolved the issue by replacing node-sass with sass. Recommendations: For node-sass versions 2.0.0 through 6.0.1, consider replacing node-sass with sass 1.32.13 or a later version to resolve the issue. For eZ Platform v2.5, update to a version that uses sass instead of node-sass. At the moment, there is no information about other specific fixes for this issue.