lokaimoma / bugza Goto Github PK

Vulnerable Library - Mako-1.1.6.tar.gz

A super-fast templating language that borrows the best ideas from the existing templating languages.

Library home page: https://files.pythonhosted.org/packages/af/b6/42cd322ae555aa770d49e31b8c5c28a243ba1bbb57ad927e1a5f5b064811/Mako-1.1.6.tar.gz

Dependency Hierarchy:

• alembic-1.7.5-py3-none-any.whl (Root Library)
  • ❌ Mako-1.1.6.tar.gz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

Publish Date: 2022-09-07

URL: CVE-2022-40023

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2022-09-07

Fix Resolution: Mako - 1.2.2

.github/workflows/run_tests.yml

• actions/checkout v2
• actions/setup-python v2
• actions/cache v2
• snok/install-poetry v1
• actions/cache v2

pyproject.toml

• fastapi ^0.73.0
• SQLAlchemy ^1.4.31
• strawberry-graphql ^0.95.1
• python-dotenv ^0.19.2
• alembic ^1.7.5
• aiomysql ^0.0.22
• passlib ^1.7.4
• python-multipart ^0.0.5
• python-jose ^3.3.0
• uvicorn ^0.17.1
• aiosqlite ^0.17.0
• fastapi-plugins ^0.9.0
• sse-starlette ^0.10.3
• pytest ^6.2.5
• pytest-asyncio ^0.17.2
• httpx ^0.23.0
• pytest-cov ^3.0.0