Bug 1922136 (CVE-2021-20270) - CVE-2021-20270 python-pygments: infinite loop in SML lexer may lead to DoS
Summary: CVE-2021-20270 python-pygments: infinite loop in SML lexer may lead to DoS
Alias: CVE-2021-20270
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
: 1944269 (view as bug list)
Depends On: 1933874 1933875 1933876 1933877 1935422 1936345 1936346 1936347 1922137 1935795 1935996
Blocks: CVE-2021-27291 1922138
TreeView+ depends on / blocked
Reported: 2021-01-29 10:39 UTC by Marian Rehak
Modified: 2021-03-30 07:37 UTC (History)
37 users (show)

Fixed In Version: python-pygments 2.7.4
Doc Type: If docs needed, set a value
Doc Text:
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Clone Of:
Last Closed: 2021-03-09 21:06:02 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0781 0 None None None 2021-03-09 15:15:10 UTC

Description Marian Rehak 2021-01-29 10:39:40 UTC
Infinite loop in SML lexer may lead to DoS. When the SMLLexer gets fed the string "exception" it seems to loop indefinitely.

Upstream Fix:


Comment 1 Marian Rehak 2021-01-29 10:40:24 UTC
Created python-pygments tracking bugs for this issue:

Affects: fedora-all [bug 1922137]

Comment 2 Tomas Hoger 2021-03-01 22:22:22 UTC
Upstream bug report:


Comment 3 Tomas Hoger 2021-03-01 22:23:55 UTC
The affected SMLLexer was introduced in pygements version 1.5.  Therefore the version of pygments as shipped with Red Hat Enterprise Linux 7 or earlier are not affected, as they do not include SMLLexer.

Comment 7 Tomas Hoger 2021-03-04 17:14:22 UTC
Pygments is included in the resource-agents packages as shipped with Red Hat Enterprise Linux 7 and 8, included as part of the bundled Google Cloud SDK.  There are two uses of Pygments inside that bundled Google Cloud SDK version:

* mako - This library uses multiple lexers from Pygments (Html, Xml, Javascript, Css, Python/Python3), but it does not use SML lexer.  It does not provide ways to use arbitrary Pygments' lexers.

* prompt_toolkit - This library allows specifying Pygments lexer that will be used to do syntax highlighting in command prompts.  It is used by Google Cloud SDK command line tool, but it does not specify any lexer.

There does not seem to be a way to trigger this issue in the Pygments version bundled in resource-agents packages.

Comment 14 errata-xmlrpc 2021-03-09 15:14:59 UTC
This issue has been addressed in the following products:

  Red Hat Automation Hub 4.2 for RHEL 7
  Red Hat Automation Hub 4.2 for RHEL 8

Via RHSA-2021:0781 https://access.redhat.com/errata/RHSA-2021:0781

Comment 15 Product Security DevOps Team 2021-03-09 21:06:02 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Comment 16 RaTasha Tillery-Smith 2021-03-11 13:34:55 UTC

In OpenShift Container Platform 3.11, the vulnerable version of python-pygments is embedded in the google-cloud-sdk package, which is shipped in the openshift-ansible container (aos3-installation-container). As the access to the openshift-ansible container is restricted only to cluster administrators, this component is affected but with a Low impact. The google-cloud-sdk package was shipped in OpenShift Container Platform 4.1, which is End of Life.

Comment 19 Tapas Jena 2021-03-30 07:37:48 UTC
*** Bug 1944269 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.