Bug 1922136 (CVE-2021-20270) - CVE-2021-20270 python-pygments: Infinite loop in SML lexer may lead to DoS
Summary: CVE-2021-20270 python-pygments: Infinite loop in SML lexer may lead to DoS
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-20270
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1944269 (view as bug list)
Depends On: 1936345 1936346 1936347 1922137 1933874 1933875 1933876 1933877 1935422 1935795 1935996 1969502
Blocks: 1922138 CVE-2021-27291
TreeView+ depends on / blocked
 
Reported: 2021-01-29 10:39 UTC by Marian Rehak
Modified: 2021-11-09 17:25 UTC (History)
37 users (show)

Fixed In Version: python-pygments 2.7.4
Doc Type: If docs needed, set a value
Doc Text:
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Clone Of:
Environment:
Last Closed: 2021-03-09 21:06:02 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0781 0 None None None 2021-03-09 15:15:10 UTC
Red Hat Product Errata RHSA-2021:3252 0 None None None 2021-08-24 08:05:26 UTC
Red Hat Product Errata RHSA-2021:4139 0 None None None 2021-11-09 17:21:02 UTC
Red Hat Product Errata RHSA-2021:4150 0 None None None 2021-11-09 17:24:53 UTC
Red Hat Product Errata RHSA-2021:4151 0 None None None 2021-11-09 17:25:05 UTC

Description Marian Rehak 2021-01-29 10:39:40 UTC 
Infinite loop in SML lexer may lead to DoS. When the SMLLexer gets fed the string "exception" it seems to loop indefinitely.

Upstream Fix:

https://github.com/pygments/pygments/commit/f91804ff4772e3ab41f46e28d370f57898700333
Comment 1 Marian Rehak 2021-01-29 10:40:24 UTC 
Created python-pygments tracking bugs for this issue:

Affects: fedora-all [bug 1922137]
Comment 2 Tomas Hoger 2021-03-01 22:22:22 UTC 
Upstream bug report:

https://github.com/pygments/pygments/issues/1625
Comment 3 Tomas Hoger 2021-03-01 22:23:55 UTC 
The affected SMLLexer was introduced in pygements version 1.5.  Therefore the version of pygments as shipped with Red Hat Enterprise Linux 7 or earlier are not affected, as they do not include SMLLexer.
Comment 7 Tomas Hoger 2021-03-04 17:14:22 UTC 
Pygments is included in the resource-agents packages as shipped with Red Hat Enterprise Linux 7 and 8, included as part of the bundled Google Cloud SDK.  There are two uses of Pygments inside that bundled Google Cloud SDK version:

* mako - This library uses multiple lexers from Pygments (Html, Xml, Javascript, Css, Python/Python3), but it does not use SML lexer.  It does not provide ways to use arbitrary Pygments' lexers.

* prompt_toolkit - This library allows specifying Pygments lexer that will be used to do syntax highlighting in command prompts.  It is used by Google Cloud SDK command line tool, but it does not specify any lexer.

There does not seem to be a way to trigger this issue in the Pygments version bundled in resource-agents packages.
Comment 14 errata-xmlrpc 2021-03-09 15:14:59 UTC 
This issue has been addressed in the following products:

  Red Hat Automation Hub 4.2 for RHEL 7
  Red Hat Automation Hub 4.2 for RHEL 8

Via RHSA-2021:0781 https://access.redhat.com/errata/RHSA-2021:0781
Comment 15 Product Security DevOps Team 2021-03-09 21:06:02 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20270
Comment 16 RaTasha Tillery-Smith 2021-03-11 13:34:55 UTC 
Statement:

In OpenShift Container Platform 3.11, the vulnerable version of python-pygments is embedded in the google-cloud-sdk package, which is shipped in the openshift-ansible container (aos3-installation-container). As the access to the openshift-ansible container is restricted only to cluster administrators, this component is affected but with a Low impact. The google-cloud-sdk package was shipped in OpenShift Container Platform 4.1, which is End of Life.
Comment 19 Tapas Jena 2021-03-30 07:37:48 UTC 
*** Bug 1944269 has been marked as a duplicate of this bug. ***
Comment 20 errata-xmlrpc 2021-08-24 08:05:23 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:3252 https://access.redhat.com/errata/RHSA-2021:3252
Comment 21 errata-xmlrpc 2021-11-09 17:20:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4139 https://access.redhat.com/errata/RHSA-2021:4139
Comment 22 errata-xmlrpc 2021-11-09 17:24:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4150 https://access.redhat.com/errata/RHSA-2021:4150
Comment 23 errata-xmlrpc 2021-11-09 17:25:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4151 https://access.redhat.com/errata/RHSA-2021:4151
Note You need to log in before you can comment on or make changes to this bug.