search

Seagate / cortx-rgw

Ceph is a distributed object, block, and file storage platform. This repo is a fork of that repo that the CORTX community uses to stage our changes for the purposes of creating and maintaining a motr SAL backend for RGW.
https://github.com/Seagate/cortx
Other
5 stars 32 forks source link

CVE-2022-34749 (High) detected in mistune-0.8.4-py2.py3-none-any.whl #376

Closed mend-for-github-com[bot] closed 7 months ago

mend-for-github-com[bot] commented 2 years ago

CVE-2022-34749 - High Severity Vulnerability

Vulnerable Library - mistune-0.8.4-py2.py3-none-any.whl

The fastest markdown parser in pure Python

Library home page: https://files.pythonhosted.org/packages/09/ec/4b43dae793655b7d8a25f76119624350b4d65eb663459eb9603d7f1f0345/mistune-0.8.4-py2.py3-none-any.whl

Path to dependency file: /src/ceph-volume

Path to vulnerable library: /src/ceph-volume,/src/pybind/cephfs,/src/tools/cephfs/top,/admin/doc-requirements.txt,/src/pybind/rados,/admin/doc-requirements.txt

Dependency Hierarchy: - :x: **mistune-0.8.4-py2.py3-none-any.whl** (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.

Publish Date: 2022-07-25

URL: CVE-2022-34749

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-fw3v-x4f2-v673

Release Date: 2022-07-25

Fix Resolution: mistune - 2.0.3

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

mend-for-github-com[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-for-github-com[bot] commented 1 year ago

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

shailesh-vaidya commented 7 months ago

Closing as an obsolete