Skip to content
OpenAdvisories
Low ALAS2-2023-2188 1 CVE

Low: python-configobj security update (Amazon Linux 2)

Published Aug 3, 2023 · Updated Aug 8, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-26112: All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2 python-configobj 0:4.7.2-7.amzn2.0.1

Vulnerabilities 1

  • Low 3.7
    CVE-2023-26112

    configobj ReDoS exploitable by developer using values in a server-side configuration file

    All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side co…

    configobj configobj py3.14-configobj configobj Debian Ubuntu Wolfi PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-26112.html