CVE-2021-27291
17.03.2021, 13:15
In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| pygments | pygments | 1.1 ≤ 𝑥 < 2.7.4 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
𝑥
= Vulnerable software versions
Debian Releases
Debian Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| mediawiki |
| ||||||||||||
| pygments |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| eric |
| ||||||||||||||||||||||||||||||||
| pygments |
|
Red Hat Enterprise Linux Releases
Amazon Linux Releases
Azure Linux Releases
Common Weakness Enumeration
References