Vulnerability Description
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
CVSS Score
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sqlalchemy | Mako | < 1.2.2 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547ExploitThird Party Advisory
- https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be06Patch
- https://github.com/sqlalchemy/mako/issues/366Issue TrackingPatch
- https://lists.debian.org/debian-lts-announce/2022/09/msg00026.htmlMailing ListThird Party Advisory
- https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packageExploitThird Party Advisory
- https://pyup.io/vulnerabilities/CVE-2022-40023/50870/Third Party Advisory
- https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547ExploitThird Party Advisory
- https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be06Patch
- https://github.com/sqlalchemy/mako/issues/366Issue TrackingPatch
- https://lists.debian.org/debian-lts-announce/2022/09/msg00026.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/12/msg00004.html
- https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packageExploitThird Party Advisory
- https://pyup.io/vulnerabilities/CVE-2022-40023/50870/Third Party Advisory
FAQ
What is CVE-2022-40023?
CVE-2022-40023 is a vulnerability with a CVSS score of 7.5 (HIGH). Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
How severe is CVE-2022-40023?
CVE-2022-40023 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-40023?
Check the references section above for vendor advisories and patch information. Affected products include: Sqlalchemy Mako, Debian Debian Linux.