Inefficient regular expression complexity in configobj - CVE-2023-26112

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU79836

Inefficient regular expression complexity in configobj - CVE-2023-26112

Published: August 22, 2023


Vulnerability identifier: #VU79836
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-26112
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.


Affected software

configobj
Amazon Linux AMI
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
openSUSE Leap Micro
Public Cloud Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
Ubuntu
Basesystem Module
openSUSE Leap
Anolis OS
Fedora
IBM Watson Assistant for IBM Cloud Pak for Data
python3-configobj (Ubuntu package)
python-configobj (Ubuntu package)
python3-configobj
python-configobj
python2-configobj
python3-configobj-doc

How to mitigate CVE-2023-26112

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
python3-configobj (Ubuntu package) - addressed in versions Ubuntu Pro, 5.0.6-4ubuntu0.1, 5.0.6-5ubuntu0.1
python-configobj (Ubuntu package) - update to Ubuntu Pro
python3-configobj - addressed in versions 5.0.6-20.8.1, 5.0.6-150000.3.3.1
python-configobj - update to 5.0.6-20.8.1
python-configobj - update to 5.0.6-23
python2-configobj - update to 5.0.6-150000.3.3.1
python3-configobj - update to 5.0.8-2
python3-configobj-doc - update to 5.0.8-2
python-configobj - addressed in versions 5.0.8-6.fc37, 5.0.8-6.fc38, 5.0.8-6.fc39

External References

Related Security Bulletins