Skip to content
OpenAdvisories
Low USN-7040-1 1 CVE

configobj vulnerability

Published Sep 26, 2024 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that ConfigObj contains regex that is susceptible to
catastrophic backtracking. An attacker could possibly use this issue to
cause a regular expression denial of service.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS configobj 5.0.6-4ubuntu0.1
Ubuntu · 22.04 LTS 22.04:LTS configobj 5.0.6-5ubuntu0.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS configobj 5.0.6-2ubuntu0.16.04.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS configobj 5.0.6-2ubuntu0.18.04.1~esm1

Vulnerabilities 1

  • Low 3.7
    CVE-2023-26112

    configobj ReDoS exploitable by developer using values in a server-side configuration file

    All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side co…

    configobj configobj py3.14-configobj configobj Debian Ubuntu Wolfi PyPI

References

  • report
    https://ubuntu.com/security/CVE-2023-26112