Exponential ReDoS Vulnerability in pymatgen Package
Summary
DEBIAN-CVE-2022-42964: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method. Affects pymatgen versions < 2023.06.23+dfsg1-1. Fixed in 2023.06.23+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pymatgen is a robust Python library designed for materials analysis, particularly in computational materials science. It provides tools for manipulating and analyzing crystal structures, electronic structures, and other material properties. However, it has been identified to have a vulnerability that allows for an exponential Regular Expression Denial of Service (ReDoS) attack, which can be exploited if an attacker can supply arbitrary input to specific methods within the library.
Vulnerability Detail
The vulnerability arises from the GaussianInput.from_string method in the pymatgen package, which is susceptible to an exponential ReDoS attack. This occurs when the method processes certain types of input that can lead to excessive resource consumption, potentially causing the application to become unresponsive. If exploited, this vulnerability could lead to denial of service, affecting the availability of applications relying on pymatgen.
How To Fix
Minimum fixed version
2023.06.23+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pymatgenTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can validate and sanitize inputs before passing them to the GaussianInput.from_string method to prevent arbitrary input from being processed. This can help mitigate the risk of triggering the ReDoS attack.
Conclusion
The pymatgen package has a critical vulnerability that can lead to an exponential ReDoS attack if arbitrary input is supplied to the GaussianInput.from_string method. It is essential to update to the patched version to mitigate this risk and ensure the stability of applications using this library.
See every vulnerability recorded for pymatgen →
FAQ
A ReDoS (Regular Expression Denial of Service) attack exploits the way regular expressions are processed, causing excessive resource consumption and potentially leading to application downtime.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any installation.
If exploited, this vulnerability can lead to denial of service, making applications that rely on pymatgen unresponsive and unavailable to users.
Yes, validating and sanitizing inputs before processing them with the vulnerable method can help mitigate the risk of exploitation.
You can find more information about pymatgen, including its documentation and features, on its official repository or website.
References
Related vulnerabilities
Recent vulnerabilities recorded for pymatgen.
