In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
Weakness
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mistune | Mistune_project | * | 2.0.2 (including) |
| Red Hat Ceph Storage 7.1 | RedHat | ceph-2:18.2.1-381.el8cp | * |
| Red Hat Ceph Storage 8.1 | RedHat | ceph-2:19.2.1-331.el9cp | * |
| Red Hat Ceph Storage 8 | RedHat | rhceph/rhceph-8-rhel9:1770630907 | * |
| Mistune | Ubuntu | bionic | * |
| Mistune | Ubuntu | esm-apps/xenial | * |
| Mistune | Ubuntu | focal | * |
| Mistune | Ubuntu | kinetic | * |
| Mistune | Ubuntu | upstream | * |
| Mistune | Ubuntu | xenial | * |
Potential Mitigations
Related Attack Patterns
References
- https://github.com/lepture/mistune/commit/a6d43215132fe4f3d93f8d7e90ba83b16a0838b2
- https://github.com/lepture/mistune/releases
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQHXITQ2DSBYOILKHXBSBB7PFBPZHF63/
- https://github.com/lepture/mistune/commit/a6d43215132fe4f3d93f8d7e90ba83b16a0838b2
- https://github.com/lepture/mistune/releases
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQHXITQ2DSBYOILKHXBSBB7PFBPZHF63/