CVE-2021-29063: ReDOS in Mpmath
Summary
CVE-2021-29063: ReDOS in Mpmath. Affects mpmath versions < 1.3.0. Fixed in 1.3.0. How to fix ↓
Also tracked for
- mpmath · Debian:11
The same CVE-2021-29063 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mpmath is a Python library that provides arbitrary-precision arithmetic. It is commonly used for numerical computations and mathematical functions. The library allows users to perform accurate calculations with high precision. However, a vulnerability has been discovered in Mpmath v1.0.0 that can lead to a Regular Expression Denial of Service (ReDOS) when the mpmathify function is called.
Vulnerability Detail
The ReDOS vulnerability in Mpmath v1.0.0 arises due to insufficient input validation in the mpmathify function. An attacker can exploit this vulnerability by providing a specially crafted input that triggers a catastrophic backtracking scenario. This can cause the function to consume excessive CPU resources, leading to a denial of service condition. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5. It is important to note that this vulnerability only affects Mpmath version 1.0.0.
How To Fix
Minimum fixed version
1.3.0
This is the first release that contains the fix.
pip install --upgrade "mpmath==1.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update to the fixed version of Mpmath to ensure the security of the application.
Conclusion
The ReDOS vulnerability in Mpmath v1.0.0 can lead to a denial of service condition when the mpmathify function is called. It is crucial to update to the fixed version, Mpmath 1.3.0, to mitigate the risk of exploitation. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mpmath →
FAQ
Mpmath is a Python library that provides arbitrary-precision arithmetic for numerical computations and mathematical functions.
The vulnerability can be exploited to cause a denial of service condition by consuming excessive CPU resources.
Only Mpmath version 1.0.0 is affected by this vulnerability.
To fix this vulnerability, update your Mpmath installation to version 1.3.0 or later.
No, there is no known workaround for this vulnerability. Updating to the fixed version is necessary.
References
Related vulnerabilities
Recent vulnerabilities recorded for mpmath.
