Bug 828488 – <app-text/calibre-5.32.0: ReDoS vulnerability (CVE-2021-44686)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sam James 2021-12-07 07:02:09 UTC]

See https://bugs.launchpad.net/calibre/+bug/1951979:
"calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conversion/preprocess.py."

[Comment 1 Sam James 2021-12-07 07:02:27 UTC]

Please stable when ready, thanks!

[Comment 2 Zac Medico 2022-06-01 15:19:20 UTC]

calibre-5.43.0 is stable now.

[Comment 3 John Helmert III 2022-06-02 04:05:46 UTC]

Thanks! Please cleanup

[Comment 4 Eli Schwartz 2023-10-19 22:23:08 UTC]

The last ebuild that was from < 5.32 was dropped in February via https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2a5e53723dc747c2175b5649431a357cf1d80574

This can be closed now.

[Comment 5 Sam James 2023-10-19 23:06:45 UTC]

(In reply to Eli Schwartz from comment #4)
> The last ebuild that was from < 5.32 was dropped in February via
> https://gitweb.gentoo.org/repo/gentoo.git/commit/
> ?id=2a5e53723dc747c2175b5649431a357cf1d80574
> 
> This can be closed now.

Yes - although we still need to decide if it merits a GLSA (we're rather behind and catching up atm).

[Comment 6 Sam James 2023-11-14 02:05:42 UTC]

Most ReDoS isn't GLSA worthy. All done.