CVE-2022-40023

Katalog CVE

CVSS 7.5 · High EPSS 2,2%

Kerentanan Inefficient Regular Expression Complexity pada sqlalchemy mako, debian linux. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

Rincian

Terbit di NVD

7 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 81,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c patch
• https://github.com/sqlalchemy/mako/issues/366 issue tracking · patch
• https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21 exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/09/msg00026.html mailing list · advisory pihak ketiga
• https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/ exploit · advisory pihak ketiga
• https://pyup.io/vulnerabilities/CVE-2022-40023/50870/ advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/12/msg00004.html