Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-40897

CVE-2022-40897: pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-40897
GHSA ID
GHSA-r9hx-vwmv-q579
EPSS Score
0.54267%
CWE
CWE-1333
Published
12/23/2022
Updated
11/19/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
setuptoolspip< 65.5.165.5.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability is a ReDoS caused by an inefficient regular expression REL defined in setuptools/package_index.py. The patch commit 43a9c9bfa6aa626ec2a22540bea28d2ca77964be directly modifies this regex. By inspecting the code of setuptools/package_index.py at commit fe8a98e696241487ba6ac9f91faa38ade939ec5d (the version before the fix, as indicated by a reference URL), the REL regex is used within the _parse_links method of the PackageIndex class. This method iterates over page content using REL.finditer(page), which is where the ReDoS would be triggered by malicious HTML input. The test test_REL_DoS in the test suite further confirms that the REL regex was the source of a DoS issue.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Pyt*on P**k**in* *ut*ority (PyP*)'s s*tuptools is * li*r*ry **si*n** to ***ilit*t* p**k**in* Pyt*on proj**ts. S*tuptools v*rsion **.*.* *n* **rli*r *oul* *llow r*mot* *tt**k*rs to **us* * **ni*l o* s*rvi** *y **t**in* m*li*ious *TML *rom * PyPI p**k*

Reasoning

T** vuln*r**ility is * R**oS **us** *y *n in***i*i*nt r**ul*r *xpr*ssion `R*L` ***in** in `s*tuptools/p**k***_in**x.py`. T** p*t** *ommit **************************************** *ir**tly mo*i*i*s t*is r***x. *y insp**tin* t** *o** o* `s*tuptools/p**