Skip to content
OpenAdvisories
Low ALAS2023-2023-254 1 CVE

Low: python-configobj security update (Amazon Linux 2023)

Published Jul 17, 2023 · Updated Jul 20, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-26112: All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 python3-configobj 0:5.0.6-23.amzn2023.0.3

Vulnerabilities 1

  • Low 3.7
    CVE-2023-26112

    configobj ReDoS exploitable by developer using values in a server-side configuration file

    All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side co…

    configobj configobj py3.14-configobj configobj Debian Ubuntu Wolfi PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-26112.html