PyPI/mistune CVE-2022-34749: high 8.6, EPSS 1.62%
Mistune vulnerable to catastrophic backtracking
Action: Upgrade mistune to 2.0.3 or later.
pip install mistune==2.0.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0a1 | 2.0.3 | - |
Fixed versions
| 2.0.3 |
Sources
- osv: GHSA-fw3v-x4f2-v673
- https://nvd.nist.gov/vuln/detail/CVE-2022-34749
- https://github.com/lepture/mistune/issues/314#issuecomment-1223972386
- https://github.com/lepture/mistune/commit/a6d43215132fe4f3d93f8d7e90ba83b16a0838b2
- https://github.com/lepture/mistune/commit/ca1e7b506850f4e488823fc7338b49a8f9852718
- https://github.com/lepture/mistune
- https://github.com/lepture/mistune/releases
- https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2022-237.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQHXITQ2DSBYOILKHXBSBB7PFBPZHF63
CVE-2022-34749 · published · modified · JSON