CVE-2021-27291 — Regex Denial of Service in Pygments

CWE-1333 — Regex Denial of ServiceCWE-400 — Uncontrolled Resource Consumption10 documents7 sources
Severity
7.5HIGHNVD
EPSS
3.4%
top 12.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
14
MediawikiPygmentsDebian Mediawiki+11 more
Timeline
PublishedMar 17
Latest updateAug 14

Description

In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages15 packages

▶debiandebian/pygments< mediawiki 1:1.35.2-1 (bookworm)
▶NVDpygments/pygments1.1 — 2.7.4
▶PyPIpygments/pygments1.1 — 2.7.4
▶Debianpygments/pygments< 2.7.1+dfsg-2.1+3
▶Ubuntupygments/pygments< 1.6+dfsg-1ubuntu1.1+esm1

Also affects: Debian Linux 10.0, 9.0, Fedora 32, 33

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
pygments vulnerabilities↗2023-08-14
▶
OSV
Pygments vulnerable to Regular Expression Denial of Service (ReDoS)↗2021-03-29
▶
GHSA
Pygments vulnerable to Regular Expression Denial of Service (ReDoS)↗2021-03-29
▶
OSV
CVE-2021-27291: In pygments 1↗2021-03-17
▶

📋Vendor Advisories

5
Ubuntu
Pygments vulnerabilities↗2023-08-14
▶
Ubuntu
Pygments vulnerability↗2021-03-30
▶
Microsoft
In pygments 1.1+ fixed in 2.7.4 the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and ↗2021-03-09
▶
Red Hat
python-pygments: ReDoS in multiple lexers↗2021-01-11
▶
Debian
CVE-2021-27291: mediawiki - In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages...↗2021
▶
CVE-2021-27291 — Regex Denial of Service in Pygments | cvebase