-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| setuptools | pip | < 65.5.1 | 65.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a ReDoS caused by an inefficient regular expression REL defined in setuptools/package_index.py. The patch commit 43a9c9bfa6aa626ec2a22540bea28d2ca77964be directly modifies this regex. By inspecting the code of setuptools/package_index.py at commit fe8a98e696241487ba6ac9f91faa38ade939ec5d (the version before the fix, as indicated by a reference URL), the REL regex is used within the _parse_links method of the PackageIndex class. This method iterates over page content using REL.finditer(page), which is where the ReDoS would be triggered by malicious HTML input. The test test_REL_DoS in the test suite further confirms that the REL regex was the source of a DoS issue.