CVE-2021-44686

EUVD-2021-31502
calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conversion/preprocess.py.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 61%
Affected Products (NVD)
VendorProductVersion
calibre-ebookcalibre
𝑥
< 5.32.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
calibre
bookworm
6.13.0+repack-2+deb12u4
fixed
bullseye
vulnerable
bullseye (security)
5.12.0+dfsg-1+deb11u3
fixed
buster
no-dsa
sid
7.20.0+ds-1
fixed
stretch
no-dsa
trixie
7.20.0+ds-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
calibre
bionic
needed
focal
needed
hirsute
ignored
impish
ignored
jammy
needed
kinetic
ignored
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
ignored
xenial
needs-triage
Common Weakness Enumeration
References
https://bugs.launchpad.net/calibre/+bug/1951979
https://github.com/dwisiswant0/advisory/issues/18
https://github.com/kovidgoyal/calibre/compare/v5.31.1...v5.32.0
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7QKFPYJ23KG6WJ5NIYAM4N2NWZCLQGL/
https://bugs.launchpad.net/calibre/+bug/1951979
https://github.com/dwisiswant0/advisory/issues/18
https://github.com/kovidgoyal/calibre/compare/v5.31.1...v5.32.0
https://lists.debian.org/debian-lts-announce/2024/09/msg00005.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7QKFPYJ23KG6WJ5NIYAM4N2NWZCLQGL/