In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
Weakness
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mistune | Mistune_project | * | 2.0.2 (including) |
| Red Hat Ceph Storage 7.1 | RedHat | ceph-2:18.2.1-381.el8cp | * |
| Red Hat Ceph Storage 8.1 | RedHat | ceph-2:19.2.1-331.el9cp | * |
| Red Hat Ceph Storage 8 | RedHat | rhceph/rhceph-8-rhel9:sha256:c571ca5630d65b34f08776d61f6be269a5e819dd870a99530993adc50c19e43e | * |
| Mistune | Ubuntu | bionic | * |
| Mistune | Ubuntu | focal | * |
| Mistune | Ubuntu | kinetic | * |
| Mistune | Ubuntu | upstream | * |
| Mistune | Ubuntu | xenial | * |
Extended Description
Attackers can create crafted inputs that
intentionally cause the regular expression to use
excessive backtracking in a way that causes the CPU
consumption to spike.
Potential Mitigations
Related Attack Patterns
References
- https://github.com/lepture/mistune/commit/a6d43215132fe4f3d93f8d7e90ba83b16a0838b2
- https://github.com/lepture/mistune/releases
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQHXITQ2DSBYOILKHXBSBB7PFBPZHF63/
- https://github.com/lepture/mistune/commit/a6d43215132fe4f3d93f8d7e90ba83b16a0838b2
- https://github.com/lepture/mistune/releases
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQHXITQ2DSBYOILKHXBSBB7PFBPZHF63/