Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 827977 - <dev-python/markdown2-2.4.2: ReDoS on "auto linking urls"
Summary: <dev-python/markdown2-2.4.2: ReDoS on "auto linking urls"
Status: IN_PROGRESS
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [glsa?]
Keywords:
Depends on: 828024
Blocks:
  Show dependency tree
 
Reported: 2021-12-02 07:29 UTC by Michał Górny
Modified: 2021-12-03 08:43 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2021-12-02 07:29:55 UTC 
From Changelog:

+- [pull #410] Be more strict on auto linking urls, RE DOS fix

It's hard to find anything.  The PR is:

https://github.com/trentm/python-markdown2/pull/410

However, the issue referenced gives 404, so it's probably hidden somehow.  Not sure if it's really ReDOS or XSS.
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-12-02 15:59:36 UTC 
Thank you! Please stable when ready.
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-12-02 22:13:49 UTC 
Thank you!
Comment 3 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2021-12-03 08:43:09 UTC 
(cleanup done)