CVE-2022-40896

Advisory

Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40896
• https://pypi.org/project/Pygments/
• https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2/
• https://github.com/pygments/pygments/blob/master/pygments/lexers/smithy.py#L61