GNU bug report logs - #47351
python-pygments@2.7.3 is vulnerable to at least CVE-2021-20270

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
Cc: tracker <at> debbugs.gnu.org
Subject: bug#47351: closed (python-pygments <at> 2.7.3 is vulnerable to at
 least CVE-2021-20270)
Date: Wed, 23 Mar 2022 02:33:02 +0000

[Message part 1 (text/plain, inline)]

Your message dated Tue, 22 Mar 2022 22:31:58 -0400
with message-id <878rt11js1.fsf <at> gmail.com>
and subject line Re: bug#47351: python-pygments <at> 2.7.3 is vulnerable to at least CVE-2021-20270
has caused the debbugs.gnu.org bug report #47351,
regarding python-pygments <at> 2.7.3 is vulnerable to at least CVE-2021-20270
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
47351: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=47351
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Léo Le Bouter <lle-bout <at> zaclys.net>
To: bug-guix <at> gnu.org
Subject: python-pygments <at> 2.7.3 is vulnerable to at least CVE-2021-20270
Date: Wed, 24 Mar 2021 00:20:14 +0100

[Message part 3 (text/plain, inline)]

CVE-2021-20270	23.03.21 18:15
An infinite loop in SMLLexer in Pygments
versions 1.5 to 2.7.3 may lead to denial of service when performing
syntax highlighting of a Standard ML (SML) source file, as demonstrated
by input that only contains the "exception" keyword.

Upstream version 2.8.1 is not affected.

Because this package would cause 456 dependents to be rebuilt, I
prepared 69e3b7f4bea9ab6c9520c5b5bdc14e0388475c3d and will push soon to
staging once master is merged in it so that .guix-authorizations
contains my key. I also attached the patch (trivial).

Opening this bug to track when this lands into master

[0001-gnu-python-pygments-Update-to-2.8.1-security-fixes.patch (text/x-patch, attachment)]

[signature.asc (application/pgp-signature, inline)]

[Message part 6 (message/rfc822, inline)]

From: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
To: Léo Le Bouter <lle-bout <at> zaclys.net>
Cc: 47351-done <at> debbugs.gnu.org
Subject: Re: bug#47351: python-pygments <at> 2.7.3 is vulnerable to at least
 CVE-2021-20270
Date: Tue, 22 Mar 2022 22:31:58 -0400

Léo Le Bouter <lle-bout <at> zaclys.net> writes:

> CVE-2021-20270	23.03.21 18:15
> An infinite loop in SMLLexer in Pygments
> versions 1.5 to 2.7.3 may lead to denial of service when performing
> syntax highlighting of a Standard ML (SML) source file, as demonstrated
> by input that only contains the "exception" keyword.
>
> Upstream version 2.8.1 is not affected.

Which is now the current version packaged in Guix.

Thanks for the report!

Closing.

Maxim

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.