869095 – (CVE-2022-40023) <dev-python/mako-1.2.2: REDoS in Lexer class

Bug 869095 (CVE-2022-40023) - <dev-python/mako-1.2.2: REDoS in Lexer class

Summary: <dev-python/mako-1.2.2: REDoS in Lexer class

Status:	RESOLVED FIXED

Alias:	CVE-2022-40023

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor
Assignee:	Gentoo Security

URL:	https://github.com/sqlalchemy/mako/is...
Whiteboard:	B3 [noglsa]
Keywords:

Depends on:	869104
Blocks:
	Show dependency tree

Reported:	2022-09-07 17:23 UTC by John Helmert III
Modified:	2022-09-26 13:51 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2022-09-07 17:23:21 UTC

CVE-2022-40023:

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

Patch: https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c

Please stabilize 1.2.2.

Comment 1 John Helmert III archtester

2022-09-07 18:06:33 UTC

Thanks!

Comment 2 Larry the Git Cow gentoo-dev

2022-09-08 05:42:22 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6c976cc7ae26b4f3d45ef9656880214e8894da5e

commit 6c976cc7ae26b4f3d45ef9656880214e8894da5e
Author:     Michał Górny <mgorny@gentoo.org>
AuthorDate: 2022-09-08 05:41:48 +0000
Commit:     Michał Górny <mgorny@gentoo.org>
CommitDate: 2022-09-08 05:42:13 +0000

    dev-python/mako: Remove old
    
    Bug: https://bugs.gentoo.org/869095
    Signed-off-by: Michał Górny <mgorny@gentoo.org>

 dev-python/mako/Manifest          |  1 -
 dev-python/mako/mako-1.2.1.ebuild | 58 ---------------------------------------
 2 files changed, 59 deletions(-)

Comment 3 John Helmert III archtester

2022-09-09 04:37:05 UTC

Thanks!

Comment 4 John Helmert III archtester

2022-09-26 13:51:50 UTC

Seems only exploitable in niche cases and even then only DoS, no glsa. All done!