CVE-2023-26112

Public on 2023-04-03
Modified on 2024-07-01
Description
All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.
Severity
Low severity
Low
CVSS v3 Base Score
3.7
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 python-configobj No Fix Planned
Amazon Linux 2 - Core python-configobj 2023-08-03 ALAS2-2023-2188 Fixed
Amazon Linux 2023 python-configobj 2023-07-17 ALAS2023-2023-254 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD CVSSv3 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L