Catastrophic Backtracking Vulnerability in Mistune Package
Summary
CVE-2022-34749: In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. Affects mistune versions < a6d43215132fe4f3d93f8d7e90ba83b16a0838b2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mistune is a fast and efficient Markdown parser for Python, widely used for converting Markdown text into HTML. It is known for its speed and ease of use, making it a popular choice among developers. However, certain versions of Mistune are vulnerable to a specific issue that can lead to performance degradation under certain conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2022-34749, arises from the way Mistune implements support for inline markup using regular expressions. In specific edge cases, this implementation can lead to catastrophic backtracking, where the regex engine takes an excessive amount of time to process certain inputs. This can result in denial of service conditions, as the application may become unresponsive when processing maliciously crafted Markdown content. The vulnerability affects versions of Mistune prior to 2.0.3-1 in Debian ecosystems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider sanitizing input Markdown content to avoid triggering the regex patterns that lead to catastrophic backtracking. Implementing a timeout mechanism for processing Markdown can also help mitigate the impact of this vulnerability.
Conclusion
The CVE-2022-34749 vulnerability in the Mistune package poses a significant risk due to its potential for catastrophic backtracking. Users are strongly advised to upgrade to the latest version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mistune →
FAQ
CVE-2022-34749 is a vulnerability in the Mistune package that allows for catastrophic backtracking in regex processing, potentially leading to denial of service.
Versions of Mistune prior to 2.0.3-1 are affected in Debian ecosystems.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Catastrophic backtracking occurs when a regular expression engine takes an excessive amount of time to process certain inputs, often leading to performance issues or application unresponsiveness.
The CVSS score for CVE-2022-34749 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mistune.
