Infinite loop in pygments - CVE-2021-20270

Vulnerability identifier: #VU51449

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20270

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop. A remote attacker can consume all available system resources and cause denial of service conditions.

pygments
IBM Cloud Pak for Watson AIOps
PowerStore T
Ansible Automation Platform
Cloud Pak for Security (CP4S)
MediaWiki
mediawiki (Debian package)
pygments (Debian package)
SUSE Linux Enterprise Module for Packagehub Subpackages
python-pygments (Ubuntu package)
python3-pygments (Ubuntu package)
python-galaxy-importer (Red Hat package)
python-pulp-ansible (Red Hat package)
python-bleach-allowlist (Red Hat package)
python3-Pygments
python2-Pygments
python3-pygments
python-pygments
python2-pygments
python-pygments-help
python-bleach (Red Hat package)
resource-agents (Red Hat package)
python-galaxy-ng (Red Hat package)
automation-hub (Red Hat package)
SUSE CaaS Platform
SUSE Enterprise Storage
Fedora
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Basesystem
openEuler

Install updates from vendor's website.

pygments - update to 2.7.4
Cloud Pak for Security (CP4S) - update to 1.10.7.0
MediaWiki - addressed in versions 1.31.13, 1.35.2
mediawiki (Debian package) - update to 1:1.31.14-1~deb10u1
pygments (Debian package) - update to 2.3.1+dfsg-1+deb10u1
python-pygments (Ubuntu package) - addressed in versions Ubuntu Pro, 2.1+dfsg-1ubuntu0.1, 2.2.0+dfsg-1ubuntu0.1, 2.3.1+dfsg-1ubuntu2.1
python3-pygments (Ubuntu package) - addressed in versions Ubuntu Pro, 2.1+dfsg-1ubuntu0.1, 2.2.0+dfsg-1ubuntu0.1, 2.3.1+dfsg-4ubuntu0.1, 2.3.1+dfsg-1ubuntu2.1
python-galaxy-importer (Red Hat package) - addressed in versions 0.2.15-1.el7pc, 0.2.15-1.el8pc
python-pulp-ansible (Red Hat package) - addressed in versions 0.5.6-1.el7pc, 0.5.6-1.el8pc
python-bleach-allowlist (Red Hat package) - addressed in versions 1.0.3-1.el7pc, 1.0.3-1.el8pc
python3-Pygments - addressed in versions 2.2.0-4.6.1, 2.6.1-7.7.1
python2-Pygments - update to 2.2.0-4.6.1
python3-pygments - update to 2.4.2-1.el7
python-pygments - update to 2.5.2-3
python3-pygments - update to 2.5.2-3
python2-pygments - update to 2.5.2-3
python-pygments-help - update to 2.5.2-3
python-bleach (Red Hat package) - addressed in versions 3.3.0-1.el7pc, 3.3.0-1.el8pc
IBM Cloud Pak for Watson AIOps - update to 3.5
PowerStore T - update to 3.5.0.1-2083289
resource-agents (Red Hat package) - update to 4.1.1-98.el8
python-galaxy-ng (Red Hat package) - addressed in versions 4.2.2-1.el7pc, 4.2.2-1.el8pc
automation-hub (Red Hat package) - addressed in versions 4.2.2-1.el7pc, 4.2.2-1.el8pc

• https://github.com/pygments/pygments/issues/1625
• https://github.com/pygments/pygments/commit/f91804ff4772e3ab41f46e28d370f57898700333

• Infinite loop in pygments
• Debian update for pygments
• Multiple vulnerabilities in MediaWiki
• Debian update for mediawiki
• Multiple vulnerabilities in Red Hat Ansible Automation Platform
• SUSE update for python-Pygments
• SUSE update for python-Pygments
• Ubuntu update for pygments
• Multiple Vulnerabilities in IBM CloudPak for Watson AIOPs
• Red Hat Enterprise Linux 8 update for resource-agents
• Ubuntu update for pygments
• Fedora EPEL 7 update for python3-pygments
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• openEuler 20.03 LTS SP1 update for python-pygments
• Red Hat Enterprise Linux 8 update for the python36:3.6 module
• Red Hat Enterprise Linux 8 update for the python27:2.7 module