CVE-2020-23478: Regular Expression Denial of Service (ReDoS) in Leo Editor v6.2.1
Summary
CVE-2020-23478: Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py. Affects leo versions < 6.3. Fixed in 6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Leo Editor is a software package available on PyPI that provides a powerful and customizable text editor for programmers. It offers various features and plugins to enhance the editing experience. However, version 6.2.1 of Leo Editor has been found to contain a regular expression denial of service (ReDoS) vulnerability in the 'plugins/importers/dart.py' component.
Vulnerability Detail
The identified vulnerability in Leo Editor v6.2.1 is a regular expression denial of service (ReDoS) issue. This type of vulnerability occurs when a regular expression pattern can be manipulated in a way that causes the matching engine to exhibit exponential time complexity. An attacker can exploit this vulnerability by providing a specially crafted input that triggers the excessive backtracking behavior of the regular expression engine. As a result, the application becomes unresponsive or experiences significant slowdowns, leading to a denial of service condition. This vulnerability can be exploited remotely without authentication, potentially impacting the availability of Leo Editor instances.
How To Fix
Minimum fixed version
6.3
This is the first release that contains the fix.
pip install --upgrade "leo==6.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of Leo Editor.
Conclusion
Leo Editor v6.2.1 is affected by a regular expression denial of service (ReDoS) vulnerability in the 'plugins/importers/dart.py' component. Users should upgrade to version 6.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for leo →
FAQ
Leo Editor is a text editor designed for programmers, offering various features and plugins to enhance the editing experience.
A regular expression denial of service (ReDoS) vulnerability occurs when a regular expression pattern can be manipulated to cause excessive backtracking, leading to a denial of service condition.
An attacker can exploit this vulnerability by providing specially crafted input that triggers the excessive backtracking behavior of the regular expression engine, causing the application to become unresponsive or significantly slow down.
No, this vulnerability can be exploited remotely without authentication.
The vulnerability can lead to a denial of service condition, potentially impacting the availability of Leo Editor instances.
