CVE-2023-26112: Medium severity configobj vulnerability
All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.)\).
Note: This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26112?
CVE-2023-26112 is classified as a Regular Expression Denial of Service (ReDoS) vulnerability.
How can I fix CVE-2023-26112?
To mitigate CVE-2023-26112, update the Configobj package to version 5.0.9 or later.
Which versions of Configobj are affected by CVE-2023-26112?
All versions of Configobj prior to 5.0.9 are affected by CVE-2023-26112.
Is CVE-2023-26112 exploitable in production environments?
CVE-2023-26112 is only exploitable if a developer places the vulnerable value in a server-side configuration file.
What is the nature of the vulnerability in CVE-2023-26112?
CVE-2023-26112 allows an attacker to exploit a Regular Expression Denial of Service vulnerability via the validate function.