Wiz
Vulnerability DatabaseCVE-2022-40897

CVE-2022-40897: 
Python vulnerability analysis and mitigation

Overview

Python Packaging Authority (PyPA) setuptools before version 65.5.1 contains a Regular Expression Denial of Service (ReDoS) vulnerability in package_index.py. The vulnerability was discovered in December 2022 and allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page (PyUp Post, NVD).

Technical details

The vulnerability exists in the Regular Expression pattern used in package_index.py. The issue specifically involves a ReDoS condition where maliciously crafted input can cause excessive backtracking in the regular expression engine. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (PyUp Vulnerability).

Impact

If successfully exploited, this vulnerability can lead to a Denial of Service condition by causing the regular expression engine to enter a state of excessive backtracking, consuming system resources and potentially making the service unresponsive (Red Hat CVE).

Mitigation and workarounds

The vulnerability was fixed in setuptools version 65.5.1. The fix involves limiting the amount of whitespace to search/backtrack in the regular expression pattern. Users are recommended to upgrade to version 65.5.1 or later to address this vulnerability (GitHub Commit).

Additional resources

Source: This report was generated using AI

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues

Cloud threat landscape

Cloud threat landscape

A comprehensive threat intelligence database of cloud security incidents, actors, tools and techniques

PEACH

PEACH

A step-by-step framework for modeling and improving SaaS and PaaS tenant isolation

Get a personalized demo

Ready to see Wiz in action?

“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo