PT-2023-8449 · Pypi+5 · Pygments+5

Published 2023-07-19 · Updated 2026-04-01 · CVE-2022-40896

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pygments versions prior to 2.15.0

Description A ReDoS issue was discovered in pygments/lexers/smithy.py via SmithyLexer. The issue is related to the use of a regular expression with inefficient computational complexity. Exploitation of the issue may allow an attacker to cause a denial of service.

Recommendations For Pygments versions prior to 2.15.0, update to version 2.15.0 or later to resolve the issue. As a temporary workaround, consider disabling the SmithyLexer function until a patch is available. Restrict access to the pygments/lexers/smithy.py module to minimize the risk of exploitation.

Exploit

Fix

DoS

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

ALT-PU-2024-14582

ALT-PU-2024-3554

AZL-27502

AZL-35139

BDU:2024-00830

CVE-2022-40896

GHSA-MRWQ-X4V8-FH7P

MGASA-2024-0107

OESA-2023-1477

OESA-2023-1478

OESA-2023-1479

PYSEC-2023-117

RHSA-2024:1057

RHSA-2024:2010

USN-7128-1

Affected Products

Alt Linux

Debian

Linuxmint

Pygments

Red Os

Ubuntu

References · 49

• 🔥 https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZO4BQCIY2S2KZYHERQMKURB7AHXDBO · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40896 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-40896 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mrwq-x4v8-fh7p · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZGMXALE3HSP4OXC7UUWIKX3OXKZDTY3 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1478 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0107.html · Security Note
• https://bdu.fstec.ru/vul/2024-00830 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1479 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-40896 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1477 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35139 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7128-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-27502 · Vendor Advisory