git: 3682d8112960 - main - security/vuxml: Add devel/py-configobj <= 5.0.8
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 29 Aug 2024 07:49:17 UTC
The branch main has been updated by nivit:
URL: https://cgit.FreeBSD.org/ports/commit/?id=3682d8112960f5ae10d452e4c3ef6cfd9aced047
commit 3682d8112960f5ae10d452e4c3ef6cfd9aced047
Author: Nicola Vitale <nivit@FreeBSD.org>
AuthorDate: 2024-08-29 07:47:07 +0000
Commit: Nicola Vitale <nivit@FreeBSD.org>
CommitDate: 2024-08-29 07:48:56 +0000
security/vuxml: Add devel/py-configobj <= 5.0.8
---
security/vuxml/vuln/2024.xml | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)
diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml
index fcc8ee97968a..014f6c0b0836 100644
--- a/security/vuxml/vuln/2024.xml
+++ b/security/vuxml/vuln/2024.xml
@@ -1,3 +1,36 @@
+ <vuln vid="46419e8c-65d9-11ef-ac06-b0416f0c4c67">
+ <topic>Configobj -- Regular Expression Denial of Service attack</topic>
+ <affects>
+ <package>
+ <name>py38-configobj</name>
+ <name>py39-configobj</name>
+ <name>py310-configobj</name>
+ <name>py311-configobj</name>
+ <range><le>5.0.8</le></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>report@snyk.io reports:</p>
+ <blockquote cite="https://github.com/DiffSK/configobj/issues/232">
+ <p>All versions of the package configobj are vulnerable to Regular
+ Expression Denial of Service (ReDoS) via the validate function,
+ using (.+?)\((.*)\).**Note:** This is only exploitable in the case
+ of a developer putting the offending value in a server side
+ configuration file.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2023-26112</cvename>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2023-26112</url>
+ </references>
+ <dates>
+ <discovery>2023-04-03</discovery>
+ <entry>2024-08-29</entry>
+ </dates>
+ </vuln>
+
<vuln vid="49ef501c-62b6-11ef-bba5-2cf05da270f3">
<topic>Gitlab -- vulnerabilities</topic>
<affects>