Skip to content
OpenAdvisories
Low USN-7040-2 1 CVE

configobj vulnerability

Published Oct 14, 2024 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

USN-7040-1 fixed a vulnerability in ConfigObj. This update
provides the corresponding update for Ubuntu 14.04 LTS.

Original advisory details:

It was discovered that ConfigObj contains regex that is susceptible to
catastrophic backtracking. An attacker could possibly use this issue to
cause a regular expression denial of service.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS configobj 4.7.2+ds-5ubuntu0.1~esm1

Vulnerabilities 1

  • Low 3.7
    CVE-2023-26112

    configobj ReDoS exploitable by developer using values in a server-side configuration file

    All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side co…

    configobj configobj py3.14-configobj configobj Debian Ubuntu Wolfi PyPI

References

  • report
    https://ubuntu.com/security/CVE-2023-26112