Bug 1922136 (CVE-2021-20270)
| Summary: | CVE-2021-20270 python-pygments: Infinite loop in SML lexer may lead to DoS | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | agk, alikins, apevec, bmontgom, chousekn, cluster-maint, cmeyers, davidn, dbecker, eparis, fdinitto, gblomqui, hhorak, jburrell, jhardy, jjoyce, jokerman, jorton, jschluet, lhh, lpeer, mabashia, mburns, mhroncok, notting, nstielau, oalbrigt, osapryki, python-maint, python-sig, rhos-maint, rpetrell, sclewis, slinaber, smcdonal, sponnaga, tjena |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | python-pygments 2.7.4 | Doc Type: | If docs needed, set a value |
| Doc Text: |
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-03-09 21:06:02 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1936345, 1936346, 1936347, 1922137, 1933874, 1933875, 1933876, 1933877, 1935422, 1935795, 1935996, 1969502 | ||
| Bug Blocks: | 1922138, 1940603 | ||
|
Description
Marian Rehak
2021-01-29 10:39:40 UTC
Created python-pygments tracking bugs for this issue: Affects: fedora-all [bug 1922137] Upstream bug report: https://github.com/pygments/pygments/issues/1625 The affected SMLLexer was introduced in pygements version 1.5. Therefore the version of pygments as shipped with Red Hat Enterprise Linux 7 or earlier are not affected, as they do not include SMLLexer. Pygments is included in the resource-agents packages as shipped with Red Hat Enterprise Linux 7 and 8, included as part of the bundled Google Cloud SDK. There are two uses of Pygments inside that bundled Google Cloud SDK version: * mako - This library uses multiple lexers from Pygments (Html, Xml, Javascript, Css, Python/Python3), but it does not use SML lexer. It does not provide ways to use arbitrary Pygments' lexers. * prompt_toolkit - This library allows specifying Pygments lexer that will be used to do syntax highlighting in command prompts. It is used by Google Cloud SDK command line tool, but it does not specify any lexer. There does not seem to be a way to trigger this issue in the Pygments version bundled in resource-agents packages. This issue has been addressed in the following products: Red Hat Automation Hub 4.2 for RHEL 7 Red Hat Automation Hub 4.2 for RHEL 8 Via RHSA-2021:0781 https://access.redhat.com/errata/RHSA-2021:0781 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-20270 Statement: In OpenShift Container Platform 3.11, the vulnerable version of python-pygments is embedded in the google-cloud-sdk package, which is shipped in the openshift-ansible container (aos3-installation-container). As the access to the openshift-ansible container is restricted only to cluster administrators, this component is affected but with a Low impact. The google-cloud-sdk package was shipped in OpenShift Container Platform 4.1, which is End of Life. *** Bug 1944269 has been marked as a duplicate of this bug. *** This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2021:3252 https://access.redhat.com/errata/RHSA-2021:3252 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4139 https://access.redhat.com/errata/RHSA-2021:4139 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4150 https://access.redhat.com/errata/RHSA-2021:4150 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4151 https://access.redhat.com/errata/RHSA-2021:4151 |