CVE-2022-40023

Description

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

Affected Platforms

Weakness Type

CWE-1333

References

• https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547…
• https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be06…
• https://github.com/sqlalchemy/mako/issues/366
• https://lists.debian.org/debian-lts-announce/2022/09/msg00026.html
• https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-package…
• https://pyup.io/vulnerabilities/CVE-2022-40023/50870/