CVE-2021-29063: Regular Expression Denial of Service (ReDOS) in mpmath
Summary
CVE-2021-29063: A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 when the mpmathify function is called. Affects mpmath across 2 version ranges.
< 1.3.0
< 46d44c3c8f3244017fe1eb102d564eb4ab8ef750
Fixed in 46d44c3c8f3244017fe1eb102d564eb4ab8ef750. How to fix ↓
Also tracked for
- mpmath · Debian:11
The same CVE-2021-29063 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mpmath is a Python library that provides arbitrary-precision arithmetic and mathematical functions. It is commonly used for numerical computations and symbolic mathematics. The library offers a wide range of mathematical functions and supports high-precision floating-point arithmetic. However, a vulnerability has been discovered in version 1.0.0 of mpmath when the mpmathify function is called.
Vulnerability Detail
The vulnerability, known as Regular Expression Denial of Service (ReDOS), allows an attacker to exploit the mpmathify function, leading to a denial of service condition. By providing specially crafted input, an attacker can cause the function to enter into an inefficient regular expression matching process, resulting in excessive CPU usage and potentially causing the application to become unresponsive. This vulnerability can be triggered remotely by an attacker with the ability to control the input to the mpmathify function.
How To Fix
Minimum fixed version
46d44c3c8f3244017fe1eb102d564eb4ab8ef750
This is the first release that contains the fix.
pip install --upgrade "mpmath==46d44c3c8f3244017fe1eb102d564eb4ab8ef750"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to update to the latest version of mpmath to mitigate the risk.
Conclusion
In conclusion, the mpmath library is vulnerable to a Regular Expression Denial of Service (ReDOS) attack when the mpmathify function is called. This vulnerability can lead to a denial of service condition and should be addressed by updating to mpmath version 1.3.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mpmath →
FAQ
Mpmath is a Python library that provides arbitrary-precision arithmetic and mathematical functions.
This vulnerability can lead to a denial of service condition, potentially causing the application to become unresponsive.
To fix this vulnerability, update the mpmath package to version 1.3.0 or later.
There is no known workaround for this vulnerability. It is recommended to update to the latest version of mpmath.
Yes, this vulnerability can be triggered remotely by an attacker with the ability to control the input to the mpmathify function.
References
Related vulnerabilities
Recent vulnerabilities recorded for mpmath.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
