p PatchFirst

CVE-2023-26112

CVE-2023-26112

This page contains facts from public vulnerability sources. Check the original advisory before updating.

All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.

CVSS 3.7 · Low · EPSS 1.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • configobj

    Versions
    • ≥ 0: Affected (semver)

    No fix published

  • configobj Debian:12

    Versions
    • 5.0.8-1
    • 5.0.8-2
    • 5.0.8-3
    • 5.0.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • configobj Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.0.8-2

    Update to 5.0.8-2

  • configobj Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.0.8-2

    Update to 5.0.8-2

  • configobj PyPI

    Versions
    • 4.4.0
    • 4.5.0
    • 4.5.1
    • 4.5.2
    • 4.5.3
    • 4.6.0
    • 4.7.0
    • 4.7.1
    • 4.7.2
    • 5.0.0
    • 5.0.1
    • 5.0.2
    • 5.0.3
    • 5.0.4
    • 5.0.5
    • 5.0.6
    • 5.0.7
    • 5.0.8
    Affected ranges
    • ECOSYSTEM: < 5.0.9

    Update to 5.0.9

  • configobj Ubuntu:Pro:14.04:LTS

    Versions
    • 4.7.2+ds-5
    • 4.7.2+ds-5build1
    Affected ranges
    • ECOSYSTEM: < 4.7.2+ds-5ubuntu0.1~esm1

    Update to 4.7.2+ds-5ubuntu0.1~esm1

  • configobj Ubuntu:Pro:16.04:LTS

    Versions
    • 5.0.6-2
    Affected ranges
    • ECOSYSTEM: < 5.0.6-2ubuntu0.16.04.1~esm1

    Update to 5.0.6-2ubuntu0.16.04.1~esm1

  • configobj Ubuntu:Pro:18.04:LTS

    Versions
    • 5.0.6-2
    Affected ranges
    • ECOSYSTEM: < 5.0.6-2ubuntu0.18.04.1~esm1

    Update to 5.0.6-2ubuntu0.18.04.1~esm1

  • configobj Ubuntu:20.04:LTS

    Versions
    • 5.0.6-3
    • 5.0.6-3build1
    • 5.0.6-4
    Affected ranges
    • ECOSYSTEM: < 5.0.6-4ubuntu0.1

    Update to 5.0.6-4ubuntu0.1

  • configobj Ubuntu:22.04:LTS

    Versions
    • 5.0.6-4
    • 5.0.6-5
    Affected ranges
    • ECOSYSTEM: < 5.0.6-5ubuntu0.1

    Update to 5.0.6-5ubuntu0.1

Original sources

Check your server →