CVE-2022-34749
In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
| Software | From | Fixed in |
|---|---|---|
| mistune_project / mistune | - | 2.0.2.x |
| fedoraproject / fedora | 37 | 37.x |
Mistune
|
2.0.0 | 2.0.3 |
- https://github.com/lepture/mistune/commit/a6d43215132fe4f3d93f8d7e90ba83b16a0838b2
- https://github.com/lepture/mistune/commit/ca1e7b506850f4e488823fc7338b49a8f9852718
- https://github.com/lepture/mistune/issues/314#issuecomment-1223972386
- https://github.com/lepture/mistune/releases
- https://github.com/pypa/advisory-database/blob/main/vulns/mistune/PYSEC-2022-237.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2022-237.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQHXITQ2DSBYOILKHXBSBB7PFBPZHF63/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQHXITQ2DSBYOILKHXBSBB7PFBPZHF63/
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime