Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xd21wLTJjZjItZzlnNs4AAwjr

pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)

Python Packaging Authority (PyPA) Wheel is a reference implementation of the Python wheel packaging standard. Wheel 0.37.1 and earlier are vulnerable to a Regular Expression denial of service via attacker controlled input to the wheel cli. The vulnerable regex is used to verify the validity of Wheel file names. This has been patched in version 0.38.1.

Permalink: https://github.com/advisories/GHSA-qwmp-2cf2-g9g6
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xd21wLTJjZjItZzlnNs4AAwjr
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: over 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-qwmp-2cf2-g9g6, CVE-2022-40898
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-40898
• https://github.com/pypa/wheel/blob/main/src/wheel/wheelfile.py#L18
• https://pypi.org/project/wheel/
• https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
• https://pyup.io/vulnerabilities/CVE-2022-40898/51499/
• https://github.com/advisories/GHSA-qwmp-2cf2-g9g6

Repository: https://github.com/pypa/wheel
Blast Radius: 36.6

Affected Packages