Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1922136 (CVE-2021-20270) - CVE-2021-20270 python-pygments: Infinite loop in SML lexer may lead to DoS
Summary: CVE-2021-20270 python-pygments: Infinite loop in SML lexer may lead to DoS
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-20270
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1944269 (view as bug list)
Depends On: 1936345 1936346 1936347 1922137 1933874 1933875 1933876 1933877 1935422 1935795 1935996 1969502
Blocks: CVE-2021-27291
TreeView+ depends on / blocked
 
Reported: 2021-01-29 10:39 UTC by Marian Rehak
Modified: 2021-11-09 17:25 UTC (History)
37 users (show)

Fixed In Version: python-pygments 2.7.4
Clone Of:
Environment:
Last Closed: 2021-03-09 21:06:02 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0781 0 None None None 2021-03-09 15:15:10 UTC
Red Hat Product Errata RHSA-2021:3252 0 None None None 2021-08-24 08:05:26 UTC
Red Hat Product Errata RHSA-2021:4139 0 None None None 2021-11-09 17:21:02 UTC
Red Hat Product Errata RHSA-2021:4150 0 None None None 2021-11-09 17:24:53 UTC
Red Hat Product Errata RHSA-2021:4151 0 None None None 2021-11-09 17:25:05 UTC

Description Marian Rehak 2021-01-29 10:39:40 UTC
Infinite loop in SML lexer may lead to DoS. When the SMLLexer gets fed the string "exception" it seems to loop indefinitely.

Upstream Fix:

https://github.com/pygments/pygments/commit/f91804ff4772e3ab41f46e28d370f57898700333

Comment 1 Marian Rehak 2021-01-29 10:40:24 UTC
Created python-pygments tracking bugs for this issue:

Affects: fedora-all [bug 1922137]

Comment 2 Tomas Hoger 2021-03-01 22:22:22 UTC
Upstream bug report:

https://github.com/pygments/pygments/issues/1625

Comment 3 Tomas Hoger 2021-03-01 22:23:55 UTC
The affected SMLLexer was introduced in pygements version 1.5.  Therefore the version of pygments as shipped with Red Hat Enterprise Linux 7 or earlier are not affected, as they do not include SMLLexer.

Comment 7 Tomas Hoger 2021-03-04 17:14:22 UTC
Pygments is included in the resource-agents packages as shipped with Red Hat Enterprise Linux 7 and 8, included as part of the bundled Google Cloud SDK.  There are two uses of Pygments inside that bundled Google Cloud SDK version:

* mako - This library uses multiple lexers from Pygments (Html, Xml, Javascript, Css, Python/Python3), but it does not use SML lexer.  It does not provide ways to use arbitrary Pygments' lexers.

* prompt_toolkit - This library allows specifying Pygments lexer that will be used to do syntax highlighting in command prompts.  It is used by Google Cloud SDK command line tool, but it does not specify any lexer.

There does not seem to be a way to trigger this issue in the Pygments version bundled in resource-agents packages.

Comment 14 errata-xmlrpc 2021-03-09 15:14:59 UTC
This issue has been addressed in the following products:

  Red Hat Automation Hub 4.2 for RHEL 7
  Red Hat Automation Hub 4.2 for RHEL 8

Via RHSA-2021:0781 https://access.redhat.com/errata/RHSA-2021:0781

Comment 15 Product Security DevOps Team 2021-03-09 21:06:02 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20270

Comment 16 RaTasha Tillery-Smith 2021-03-11 13:34:55 UTC
Statement:

In OpenShift Container Platform 3.11, the vulnerable version of python-pygments is embedded in the google-cloud-sdk package, which is shipped in the openshift-ansible container (aos3-installation-container). As the access to the openshift-ansible container is restricted only to cluster administrators, this component is affected but with a Low impact. The google-cloud-sdk package was shipped in OpenShift Container Platform 4.1, which is End of Life.

Comment 19 Tapas Jena 2021-03-30 07:37:48 UTC
*** Bug 1944269 has been marked as a duplicate of this bug. ***

Comment 20 errata-xmlrpc 2021-08-24 08:05:23 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:3252 https://access.redhat.com/errata/RHSA-2021:3252

Comment 21 errata-xmlrpc 2021-11-09 17:20:59 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4139 https://access.redhat.com/errata/RHSA-2021:4139

Comment 22 errata-xmlrpc 2021-11-09 17:24:51 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4150 https://access.redhat.com/errata/RHSA-2021:4150

Comment 23 errata-xmlrpc 2021-11-09 17:25:02 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4151 https://access.redhat.com/errata/RHSA-2021:4151


Note You need to log in before you can comment on or make changes to this bug.