search

opensearch-project / sql-cli

The SQL CLI component in OpenSearch is a stand-alone Python application for query
Apache License 2.0
4 stars 13 forks source link

configobj-5.0.8-py2.py3-none-any.whl: 1 vulnerabilities (highest severity is: 5.9) - autoclosed #15

Closed mend-for-github-com[bot] closed 9 months ago

mend-for-github-com[bot] commented 1 year ago
Vulnerable Library - configobj-5.0.8-py2.py3-none-any.whl

Config file reading, writing and validation.

Library home page: https://files.pythonhosted.org/packages/d3/bb/d10e531b297dd1d46f6b1fd11d018247af9f2d460037554bb7bb9011c6ac/configobj-5.0.8-py2.py3-none-any.whl

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (configobj version) Remediation Possible**
CVE-2023-26112 Medium 5.9 configobj-5.0.8-py2.py3-none-any.whl Direct N/A ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-26112 ### Vulnerable Library - configobj-5.0.8-py2.py3-none-any.whl

Config file reading, writing and validation.

Library home page: https://files.pythonhosted.org/packages/d3/bb/d10e531b297dd1d46f6b1fd11d018247af9f2d460037554bb7bb9011c6ac/configobj-5.0.8-py2.py3-none-any.whl

Dependency Hierarchy: - :x: **configobj-5.0.8-py2.py3-none-any.whl** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.

Publish Date: 2023-04-03

URL: CVE-2023-26112

### CVSS 3 Score Details (5.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

mend-for-github-com[bot] commented 9 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.