Summary
It was discovered that Pygments incorrectly handled parsing SML files. If a
user or automated system were tricked into parsing a specially crafted SML
file, a remote attacker could cause Pygments to hang, resulting in a denial
of service.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | pygments | 2.1+dfsg-1ubuntu0.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | pygments | 2.2.0+dfsg-1ubuntu0.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | pygments | 2.3.1+dfsg-1ubuntu2.1 |
Vulnerabilities 1
-
High 7.5
Infinite Loop in Pygments
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
References
-
report
https://ubuntu.com/security/CVE-2021-20270