p PatchFirst

CVE-2022-34749

CVE-2022-34749

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.

CVSS 8.6 · High · EPSS 1.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • mistune Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.0.3-1

    Update to 2.0.3-1

  • mistune Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.0.3-1

    Update to 2.0.3-1

  • mistune Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.0.3-1

    Update to 2.0.3-1

  • mistune PyPI

    Versions
    • 2.0.0
    • 2.0.0a1
    • 2.0.0a2
    • 2.0.0a3
    • 2.0.0a4
    • 2.0.0a5
    • 2.0.0a6
    • 2.0.0rc1
    • 2.0.1
    • 2.0.2
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0a1, < 2.0.3

    Update to 2.0.3

  • mistune PyPI

    Versions
    • 2.0.0
    • 2.0.0a1
    • 2.0.0a2
    • 2.0.0a3
    • 2.0.0a4
    • 2.0.0a5
    • 2.0.0a6
    • 2.0.0rc1
    • 2.0.1
    • 2.0.2
    Affected ranges
    • GIT: < a6d43215132fe4f3d93f8d7e90ba83b16a0838b2
    • ECOSYSTEM: ≥ 2.0.0a1, < 2.0.3

    Update to 2.0.3

  • mistune Ubuntu:16.04:LTS

    Versions
    • 0.6-2
    • 0.7.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistune Ubuntu:18.04:LTS

    Versions
    • 0.7.4-1
    • 0.8-1
    • 0.8.1-1
    • 0.8.3-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistune Ubuntu:20.04:LTS

    Versions
    • 0.8.4-1
    • 0.8.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mistune Ubuntu:22.04:LTS

    Versions
    • 0.8.4-4
    • 0.8.4-5
    • 2.0.0-1+really0.8.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →