Regular Expression Denial of Service (ReDOS) Vulnerability in Mpmath Package
Summary
DEBIAN-CVE-2021-29063: A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called. Affects mpmath versions < 1.2.1-2. Fixed in 1.2.1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mpmath is a Python library for arbitrary-precision arithmetic, allowing users to perform calculations with a high degree of accuracy. It is widely used in scientific computing and mathematical applications. The library provides various functions for numerical analysis, including support for complex numbers and advanced mathematical operations. However, versions 1.0.0 through 1.2.1 of Mpmath are vulnerable to a Regular Expression Denial of Service (ReDOS) attack, which can be exploited under certain conditions.
Vulnerability Detail
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath versions 1.0.0 through 1.2.1. This vulnerability arises when the mpmathify function is called, allowing an attacker to craft specific input that can cause excessive backtracking in regular expressions. The potential ramifications include service unavailability, as the application may become unresponsive when processing malicious input, leading to denial of service for legitimate users.
How To Fix
Minimum fixed version
1.2.1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mpmathTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can validate and sanitize inputs to the mpmathify function to prevent malicious patterns from being processed. This may involve implementing stricter input validation rules or using alternative methods for handling user input.
Conclusion
The ReDOS vulnerability in Mpmath poses a significant risk to applications using affected versions of the package. It is crucial to update to the patched version to ensure the security and availability of your application. Implementing input validation can also help mitigate risks until an update can be applied.
See every vulnerability recorded for mpmath →
FAQ
The ReDOS vulnerability allows attackers to exploit the mpmathify function by providing specially crafted input that causes excessive backtracking in regular expressions, leading to potential denial of service.
Mpmath versions 1.0.0 through 1.2.1 are affected by the ReDOS vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
If an immediate update is not possible, implement input validation and sanitization as a temporary workaround to mitigate the risk of exploitation.
More information about the Mpmath vulnerability can be found in the official Debian CVE database and other security advisories related to the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for mpmath.
