New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vulnerable regex detected by Snyk. Please fix or avoid regex #240

Closed

wannfq opened this issue Aug 16, 2023 · 6 comments

wannfq commented Aug 16, 2023

configobj/src/configobj/validate.py

Line 534 in e2ba445

_func_re = re.compile(r'(.+?)\((.*)\)', re.DOTALL)

Author

wannfq commented Aug 16, 2023

Ref: https://learn.snyk.io/lesson/redos/?_gl=1*1w34pg6*_ga*NzgwNjYzODE3LjE2OTE2NDQ3MDc.*_ga_X9SH3KP7B4*MTY5MjE4NTc5OS4yMS4xLjE2OTIxODU4NjEuMC4wLjA.

IloBe commented Aug 27, 2023

Additional info:

https://quay.io/repository/eclipse/che-sidecar-go/manifest/sha256:2243f389534abc38938f454e01b6653b88ff19048ec4c3ecc0a66e652cb017d0?tab=vulnerabilities
with pip-audit lib:
configobj 5.0.8 GHSA-c33w-24p9-8m24 Failed to fix configobj (5.0.8): failed to fix dependency configobj (5.0.8), unable to find fix version for vulnerability GHSA-c33w-24p9-8m24

thebaptiste commented Aug 30, 2023 •

edited

Loading

Maintainers seem to be in long holidays, ill, retired or dead...
See PR #236 opened by @cdcadman since May 17 on this subject.

Collaborator

jelmer commented Sep 17, 2024

#236 is now merged, closing this.

jelmer closed this as completed

aarondawg14 commented Sep 17, 2024

@jelmer Has this been released yet?

Collaborator

jelmer commented Sep 17, 2024

@aarondawg14 no, see the discussion on #237

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment