CVE-2022-40023
HIGH7.5EPSS 1.0%mako - security update
發布日:2022/9/16修改日:2026/4/28
描述
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
受影響套件(6)
- Alpine/py3-makofrom 0, < 1.2.2-r0
- Debian/makofrom 0, < 1.1.3+ds1-2+deb11u1
- Debian/makofrom 0, < 1.0.7+ds1-1+deb10u1
- Debian/makofrom 0, < 1.1.3+ds1-2+deb11u1
- PyPI/makofrom 0, < 1.2.2
- PyPI/makofrom 0, < 925760291d6efec64fda6e9dd1fd9cfbd5be068c | from 0, < 1.2.2
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
參考連結(14)
- ADVISORYhttps://github.com/advisories/GHSA-v973-fxgf-6xhp
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-40023
- ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2022-40023
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2022-40023
- WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2022-260.yaml
- WEBhttps://github.com/sqlalchemy/mako
- WEBhttps://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21
- WEBhttps://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c
- WEBhttps://github.com/sqlalchemy/mako/issues/366
- WEBhttps://lists.debian.org/debian-lts-announce/2022/09/msg00026.html
- WEBhttps://lists.debian.org/debian-lts-announce/2025/12/msg00004.html
- WEBhttps://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
- WEBhttps://pyup.io/vulnerabilities/CVE-2022-40023/50870
- WEBhttps://pyup.io/vulnerabilities/CVE-2022-40023/50870/