CVE-2022-40023: High severity SQLAlchemy mako vulnerability
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/makoto a version that resolves this vulnerability.Fixed in 1.2.2
Event History
Frequently Asked Questions
What is the severity of CVE-2022-40023?
The severity of CVE-2022-40023 is high with a CVSS score of 7.5.
How does CVE-2022-40023 impact Sqlalchemy mako?
CVE-2022-40023 affects Sqlalchemy mako versions prior to 1.2.2.
Which software packages are affected by CVE-2022-40023?
Sqlalchemy mako versions prior to 1.2.2, mako package from pip, Sqlalchemy mako from the source, and Debian Linux version 10.0 are affected by CVE-2022-40023.
What is the vulnerability description of CVE-2022-40023?
CVE-2022-40023 is a vulnerability in Sqlalchemy mako before 1.2.2 that allows Regular expression Denial of Service (ReDoS) when using the Lexer class to parse.
How can I remediate CVE-2022-40023?
To remediate CVE-2022-40023, update Sqlalchemy mako to version 1.2.2 or higher.