PT-2023-9395 · Configobj+5 · Configobj+5

Darktinia · Published 2023-04-03 · Updated 2024-10-14 · CVE-2023-26112

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions configobj versions all versions

Description The issue is related to the use of a regular expression with inefficient computational complexity in the configobj package. This can be exploited to cause a denial of service. The validate function is vulnerable to Regular Expression Denial of Service (ReDoS) via the use of (.+?)((.*)). This is only exploitable in the case of a developer putting the offending value in a server-side configuration file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

BDU:2024-07015

CVE-2023-26112

GHSA-C33W-24P9-8M24

OPENSUSE-SU-2023_3369-1

OPENSUSE-SU-2024:13199-1

SUSE-SU-2023:3368-1

SUSE-SU-2023:3369-1

SUSE-SU-2023_3368-1

SUSE-SU-2023_3369-1

USN-7040-1

USN-7040-2

Affected Products

Debian

Linuxmint

Red Os

Suse

Ubuntu

Configobj

References · 36

• 🔥 https://security.snyk.io/vuln/SNYK-PYTHON-CONFIGOBJ-3252494 · Exploit
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6BO4RLMYEJODCNUE3DJIIUUFVTPAG6VN · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c33w-24p9-8m24 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NZHY7B33EFY4LESP2NI4APQUPRROTAZK · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26112 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PYU4IHVLOTYMFPH7KDOJGKZQR4GKWPFK · Vendor Advisory
• https://osv.dev/vulnerability/USN-7040-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7040-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26112 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-26112 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE58 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07015 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-26112 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26112 · Vendor Advisory