mpmath-1.2.1-py3-none-any.whl: 1 vulnerabilities (highest severity is: 7.5)
Closed this issue · 4 comments
Vulnerable Library - mpmath-1.2.1-py3-none-any.whl
Python library for arbitrary-precision floating-point arithmetic
Library home page: https://files.pythonhosted.org/packages/d4/cf/3965bddbb4f1a61c49aacae0e78fd1fe36b5dc36c797b31f30cf07dcbbb7/mpmath-1.2.1-py3-none-any.whl
Path to dependency file: /module/requirements.txt
Path to vulnerable library: /module/requirements.txt,/module
Found in HEAD commit: 1def381581db59d139b24ef0a32eed6f8e3b2af8
Vulnerabilities
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2021-29063 |  High |
7.5 | mpmath-1.2.1-py3-none-any.whl | Direct | N/A | ❌ |
Details
CVE-2021-29063
Vulnerable Library - mpmath-1.2.1-py3-none-any.whl
Python library for arbitrary-precision floating-point arithmetic
Library home page: https://files.pythonhosted.org/packages/d4/cf/3965bddbb4f1a61c49aacae0e78fd1fe36b5dc36c797b31f30cf07dcbbb7/mpmath-1.2.1-py3-none-any.whl
Path to dependency file: /module/requirements.txt
Path to vulnerable library: /module/requirements.txt,/module
Dependency Hierarchy:
- ❌ mpmath-1.2.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 1def381581db59d139b24ef0a32eed6f8e3b2af8
Found in base branch: master
Vulnerability Details
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.
Mend Note: After conducting further research, Mend has determined that all versions of mpmath through 1.2.1 are vulnerable to CVE-2021-29063.
Publish Date: 2021-06-21
URL: CVE-2021-29063
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
Nice to meet you, @mend-bolt-for-github[bot]. Thank you for creating an issue. There are some tasks for you:
- Need at least one label
- Need at least one assignee
- Need a milestone
To close issue send comment "close", to reopen - "reopen"
Nice, one of tasks is done
Micro-Learning Topic: Regular expression denial of service (Detected by phrase)
Matched on "Regular Expression Denial of Service"
Denial of Service (DoS) attacks caused by Regular Expression which causes the system to hang or cause them to work very slowly when attacker sends a well-crafted input(exponentially related to input size).Denial of service attacks significantly degrade the service quality experienced by legitimate users. These attacks introduce large response delays, excessive losses, and service interruptions, resulting in direct impact on availability.
Try a challenge in Secure Code Warrior
Micro-Learning Topic: Denial of service (Detected by phrase)
Matched on "Denial of Service"
The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. Source: https://www.owasp.org/index.php/Denial_of_Service
Try a challenge in Secure Code Warrior
Micro-Learning Topic: Vulnerable library (Detected by phrase)
Matched on "Vulnerable Library"
Use of vulnerable components will introduce weaknesses into the application. Components with published vulnerabilities will allow easy exploitation as resources will often be available to automate the process.
Try a challenge in Secure Code Warrior
Thanks for issue, @mend-bolt-for-github[bot]! @AdamOswald, thank you for closing this issue, I have less work. I will look forward to our next meeting😜
If you want to reopen the issue - type "reopen"