REDHAT-BUG-2500752: High severity pypi/soupsieve vulnerability
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/cssparser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .selectone() to cause CPU exhaustion and denial of service. This issue is fixed in version 2.8.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
soupsieveto a version that resolves this vulnerability.Fixed in 2.8.4