CVE-2014-8881: Regular Expression Denial of Service in bleach
Summary
CVE-2014-8881: Regular Expression Denial of Service in bleach. Affects bleach versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bleach package is an HTML sanitization library for Python. It provides a way to clean user-generated content of potentially harmful HTML and prevent cross-site scripting (XSS) attacks. However, all versions of the bleach package are vulnerable to a regular expression denial of service (ReDoS) attack when certain types of input are passed into the sanitize function.
Vulnerability Detail
The vulnerability in bleach arises from the way it handles certain input patterns. An attacker can craft malicious input that triggers a ReDoS attack, causing the sanitization process to consume excessive time and resources. This can lead to a denial of service (DoS) condition, where the application becomes unresponsive or crashes. The severity of this vulnerability is moderate, with a CVSS score of 5.3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. The best course of action is to migrate to a different HTML sanitization module.
Conclusion
The bleach package is no longer maintained and has a known vulnerability that can lead to a denial of service attack. It is crucial to migrate to an actively maintained alternative module to ensure the security and stability of the application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for bleach →
FAQ
The vulnerability can be exploited by an attacker to launch a denial of service attack, potentially rendering the application unresponsive or causing it to crash.
No, there is no patch available for bleach as it is no longer maintained. It is recommended to switch to an alternative module.
Yes, all versions of bleach are vulnerable to this regular expression denial of service attack.
Yes, this vulnerability can be exploited remotely by sending malicious input to the sanitize function.
The severity of this vulnerability is moderate, with a CVSS score of 5.3.
References
Related vulnerabilities
Recent vulnerabilities recorded for bleach.
