In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pygments | Pygments | 1.1 (including) | 2.7.4 (excluding) |
| Red Hat Automation Hub 4.2 for RHEL 7 | RedHat | automation-hub-0:4.2.2-1.el7pc | * |
| Red Hat Automation Hub 4.2 for RHEL 7 | RedHat | python3-django-0:2.2.18-1.el7pc | * |
| Red Hat Automation Hub 4.2 for RHEL 7 | RedHat | python-bleach-0:3.3.0-1.el7pc | * |
| Red Hat Automation Hub 4.2 for RHEL 7 | RedHat | python-bleach-allowlist-0:1.0.3-1.el7pc | * |
| Red Hat Automation Hub 4.2 for RHEL 7 | RedHat | python-galaxy-importer-0:0.2.15-1.el7pc | * |
| Red Hat Automation Hub 4.2 for RHEL 7 | RedHat | python-galaxy-ng-0:4.2.2-1.el7pc | * |
| Red Hat Automation Hub 4.2 for RHEL 7 | RedHat | python-pulp-ansible-1:0.5.6-1.el7pc | * |
| Red Hat Automation Hub 4.2 for RHEL 8 | RedHat | automation-hub-0:4.2.2-1.el8pc | * |
| Red Hat Automation Hub 4.2 for RHEL 8 | RedHat | python3-django-0:2.2.18-1.el8pc | * |
| Red Hat Automation Hub 4.2 for RHEL 8 | RedHat | python-bleach-0:3.3.0-1.el8pc | * |
| Red Hat Automation Hub 4.2 for RHEL 8 | RedHat | python-bleach-allowlist-0:1.0.3-1.el8pc | * |
| Red Hat Automation Hub 4.2 for RHEL 8 | RedHat | python-galaxy-importer-0:0.2.15-1.el8pc | * |
| Red Hat Automation Hub 4.2 for RHEL 8 | RedHat | python-galaxy-ng-0:4.2.2-1.el8pc | * |
| Red Hat Automation Hub 4.2 for RHEL 8 | RedHat | python-pulp-ansible-1:0.5.6-1.el8pc | * |
| Red Hat Enterprise Linux 8 | RedHat | python36:3.6-8050020210811103506.982725ab | * |
| Red Hat Enterprise Linux 8 | RedHat | python27:2.7-8050020210811095446.3e7ace8b | * |
| Red Hat Enterprise Linux 8 | RedHat | resource-agents-0:4.1.1-98.el8 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | python27-babel-0:0.9.6-10.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | python27-python-0:2.7.18-3.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | python27-python-jinja2-0:2.6-16.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | python27-python-pygments-0:1.5-5.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | python27-babel-0:0.9.6-10.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | python27-python-0:2.7.18-3.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | python27-python-jinja2-0:2.6-16.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | python27-python-pygments-0:1.5-5.el7 | * |
| Eric | Ubuntu | bionic | * |
| Eric | Ubuntu | devel | * |
| Eric | Ubuntu | esm-apps/jammy | * |
| Eric | Ubuntu | esm-apps/noble | * |
| Eric | Ubuntu | groovy | * |
| Eric | Ubuntu | hirsute | * |
| Eric | Ubuntu | impish | * |
| Eric | Ubuntu | jammy | * |
| Eric | Ubuntu | kinetic | * |
| Eric | Ubuntu | lunar | * |
| Eric | Ubuntu | mantic | * |
| Eric | Ubuntu | noble | * |
| Eric | Ubuntu | oracular | * |
| Eric | Ubuntu | trusty | * |
| Eric | Ubuntu | xenial | * |
| Pygments | Ubuntu | bionic | * |
| Pygments | Ubuntu | devel | * |
| Pygments | Ubuntu | focal | * |
| Pygments | Ubuntu | groovy | * |
| Pygments | Ubuntu | hirsute | * |
| Pygments | Ubuntu | impish | * |
| Pygments | Ubuntu | jammy | * |
| Pygments | Ubuntu | kinetic | * |
| Pygments | Ubuntu | lunar | * |
| Pygments | Ubuntu | mantic | * |
| Pygments | Ubuntu | noble | * |
| Pygments | Ubuntu | oracular | * |
| Pygments | Ubuntu | precise/esm | * |
| Pygments | Ubuntu | trusty | * |
| Pygments | Ubuntu | trusty/esm | * |
| Pygments | Ubuntu | upstream | * |
| Pygments | Ubuntu | xenial | * |
Attackers can create crafted inputs that
intentionally cause the regular expression to use
excessive backtracking in a way that causes the CPU
consumption to spike.