In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
For more information on CVSS3 Scores, click here.
### Suggested Fix
Type: Upgrade version
Release Date: 2021-03-17
Fix Resolution: 2.7.4
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-20270
### Vulnerable Library - Pygments-2.5.2-py2.py3-none-any.whl
Pygments is a syntax highlighting package written in Python.
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Pygments is a syntax highlighting package written in Python.
Library home page: https://files.pythonhosted.org/packages/be/39/32da3184734730c0e4d3fa3b2b5872104668ad6dc1b5a73d8e477e5fe967/Pygments-2.5.2-py2.py3-none-any.whl
Path to dependency file: /components/mlserve/requirements.txt
Path to vulnerable library: /components/mlserve/requirements.txt,/components/mlserve
Vulnerabilities
Details
CVE-2021-27291
### Vulnerable Library - Pygments-2.5.2-py2.py3-none-any.whlPygments is a syntax highlighting package written in Python.
Library home page: https://files.pythonhosted.org/packages/be/39/32da3184734730c0e4d3fa3b2b5872104668ad6dc1b5a73d8e477e5fe967/Pygments-2.5.2-py2.py3-none-any.whl
Path to dependency file: /components/mlserve/requirements.txt
Path to vulnerable library: /components/mlserve/requirements.txt,/components/mlserve
Dependency Hierarchy: - :x: **Pygments-2.5.2-py2.py3-none-any.whl** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsIn pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
Publish Date: 2021-03-17
URL: CVE-2021-27291
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2021-03-17
Fix Resolution: 2.7.4
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-20270
### Vulnerable Library - Pygments-2.5.2-py2.py3-none-any.whlPygments is a syntax highlighting package written in Python.
Library home page: https://files.pythonhosted.org/packages/be/39/32da3184734730c0e4d3fa3b2b5872104668ad6dc1b5a73d8e477e5fe967/Pygments-2.5.2-py2.py3-none-any.whl
Path to dependency file: /components/mlserve/requirements.txt
Path to vulnerable library: /components/mlserve/requirements.txt,/components/mlserve
Dependency Hierarchy: - :x: **Pygments-2.5.2-py2.py3-none-any.whl** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsAn infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Publish Date: 2021-03-23
URL: CVE-2021-20270
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-9w8r-397f-prfh
Release Date: 2021-03-23
Fix Resolution: 2.7.4
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)