Address CVE-2023-26112 ReDoS - #236
Merged
Merged
Conversation
Contributor
Author
|
My proposed fix is inspired by this link (being more precise to mitigate catastrophic backtracking): https://www.regular-expressions.info/catastrophic.html |
alex
approved these changes
Aug 7, 2023
|
@MichaelHipp @robdennis @EliAndrewC @untitaker |
Contributor
|
I do not have access to this repo
…On Wed, Aug 30, 2023, at 13:00, Jean-Baptiste VESLIN wrote:
@MichaelHipp <https://github.com/MichaelHipp> @robdennis <https://github.com/robdennis> @EliAndrewC <https://github.com/EliAndrewC> @untitaker <https://github.com/untitaker>
Is there any maintener available to review this PR please ?
#232 <#232> should be fixed in a new release...
—
Reply to this email directly, view it on GitHub <#236 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGMPRORADQSOSEA5KTSH7LXX4MODANCNFSM6AAAAAAYE5M72E>.
You are receiving this because you were mentioned.Message ID: ***@***.***>
|
|
@robdennis is it possible to merge this PR? |
|
Could someone review this pr and merge it ASAP? It is a security hole fix.. |
|
Bumping once more, this is affecting a lot of projects. |
2 tasks
|
@MichaelHipp @robdennis @EliAndrewC @untitaker Is there any roadmap on a release with this merged? It's been over a year and it's a reported vulnerability at NIST. |
Contributor
|
@frank-hopkin-accrisoft my answer is the same as last year. I am not a maintainer of this repository, and most of the people you are mentioning are neither. |
Thank you for the reply, I admittedly blindly copied someone else's mentions. |
Collaborator
|
I recently got access to the repo and have been meaning to look at this, hopefully will actually manage in the next two weeks. |
freebsd-git
pushed a commit
to freebsd/freebsd-ports
that referenced
this pull request
Aug 29, 2024
- Add a patch to fix Regular Expression Denial of Service. It is an unofficial patch [1], but it has already been applied by other projects such as Debian or Fedora [2]. - Bump PORTREVISION Reference: DiffSK/configobj#236 [1] Reference: https://salsa.debian.org/python-team/packages/configobj/-/blob/master/debian/patches/CVE-2023-26112?ref_type=heads [2] Reference: https://bodhi.fedoraproject.org/updates/FEDORA-2023-27b41bb133 [2] Security: CVE-2023-26112
nanorkyo
pushed a commit
to nanorkyo/freebsd-ports
that referenced
this pull request
Aug 31, 2024
- Add a patch to fix Regular Expression Denial of Service. It is an unofficial patch [1], but it has already been applied by other projects such as Debian or Fedora [2]. - Bump PORTREVISION Reference: DiffSK/configobj#236 [1] Reference: https://salsa.debian.org/python-team/packages/configobj/-/blob/master/debian/patches/CVE-2023-26112?ref_type=heads [2] Reference: https://bodhi.fedoraproject.org/updates/FEDORA-2023-27b41bb133 [2] Security: CVE-2023-26112
nanorkyo
pushed a commit
to nanorkyo/freebsd-ports
that referenced
this pull request
Aug 31, 2024
- Add a patch to fix Regular Expression Denial of Service. It is an unofficial patch [1], but it has already been applied by other projects such as Debian or Fedora [2]. - Bump PORTREVISION Reference: DiffSK/configobj#236 [1] Reference: https://salsa.debian.org/python-team/packages/configobj/-/blob/master/debian/patches/CVE-2023-26112?ref_type=heads [2] Reference: https://bodhi.fedoraproject.org/updates/FEDORA-2023-27b41bb133 [2] Security: CVE-2023-26112
|
Hi. Any news on this fix? Greatly appreciated! |
jelmer
approved these changes
Sep 17, 2024
camachat
pushed a commit
to camachat/freebsd-ports
that referenced
this pull request
Jul 22, 2026
- Add a patch to fix Regular Expression Denial of Service. It is an unofficial patch [1], but it has already been applied by other projects such as Debian or Fedora [2]. - Bump PORTREVISION Reference: DiffSK/configobj#236 [1] Reference: https://salsa.debian.org/python-team/packages/configobj/-/blob/master/debian/patches/CVE-2023-26112?ref_type=heads [2] Reference: https://bodhi.fedoraproject.org/updates/FEDORA-2023-27b41bb133 [2] Security: CVE-2023-26112
camachat
pushed a commit
to camachat/freebsd-ports
that referenced
this pull request
Jul 24, 2026
- Add a patch to fix Regular Expression Denial of Service. It is an unofficial patch [1], but it has already been applied by other projects such as Debian or Fedora [2]. - Bump PORTREVISION Reference: DiffSK/configobj#236 [1] Reference: https://salsa.debian.org/python-team/packages/configobj/-/blob/master/debian/patches/CVE-2023-26112?ref_type=heads [2] Reference: https://bodhi.fedoraproject.org/updates/FEDORA-2023-27b41bb133 [2] Security: CVE-2023-26112
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR would close #232 . I added a test based on the example provided.