CVE-2021-44686

calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conversion/preprocess.py.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 56%
VendorProductVersion
calibre-ebookcalibre
𝑥
< 5.32.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
calibre
bullseye
vulnerable
buster
no-dsa
stretch
no-dsa
bullseye (security)
5.12.0+dfsg-1+deb11u3
fixed
bookworm
6.13.0+repack-2+deb12u4
fixed
sid
7.20.0+ds-1
fixed
trixie
7.20.0+ds-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
calibre
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
ignored
jammy
needed
impish
ignored
hirsute
ignored
focal
needed
bionic
needed
xenial
needs-triage
trusty
ignored
Common Weakness Enumeration
References
https://bugs.launchpad.net/calibre/+bug/1951979
https://github.com/dwisiswant0/advisory/issues/18
https://github.com/kovidgoyal/calibre/compare/v5.31.1...v5.32.0
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7QKFPYJ23KG6WJ5NIYAM4N2NWZCLQGL/
https://bugs.launchpad.net/calibre/+bug/1951979
https://github.com/dwisiswant0/advisory/issues/18
https://github.com/kovidgoyal/calibre/compare/v5.31.1...v5.32.0
https://lists.debian.org/debian-lts-announce/2024/09/msg00005.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7QKFPYJ23KG6WJ5NIYAM4N2NWZCLQGL/