Hi — reporting a denial-of-service (uncontrolled resource consumption, CWE-1333 / CWE-400) in configobj 5.0.9 (latest).
The section-marker regular expression in configobj/__init__.py backtracks quadratically on crafted section-header input, so a small configuration (tens of KB) can consume many seconds of CPU (O(n²)). Any application that parses untrusted or attacker-influenced configuration with configobj can be driven into CPU exhaustion.
This is distinct from CVE-2023-26112 (which was in validate()).
This repo doesn't appear to have GitHub Private Vulnerability Reporting enabled and I couldn't find a SECURITY.md contact. Could you enable private reporting (Settings → Security) or share a security contact so I can send the full proof-of-concept privately? Happy to help with a fix.
— mohammad adnan (cystack.ps redteam) / @mohammedix88
Hi — reporting a denial-of-service (uncontrolled resource consumption, CWE-1333 / CWE-400) in configobj 5.0.9 (latest).
The section-marker regular expression in
configobj/__init__.pybacktracks quadratically on crafted section-header input, so a small configuration (tens of KB) can consume many seconds of CPU (O(n²)). Any application that parses untrusted or attacker-influenced configuration with configobj can be driven into CPU exhaustion.This is distinct from CVE-2023-26112 (which was in
validate()).This repo doesn't appear to have GitHub Private Vulnerability Reporting enabled and I couldn't find a SECURITY.md contact. Could you enable private reporting (Settings → Security) or share a security contact so I can send the full proof-of-concept privately? Happy to help with a fix.
— mohammad adnan (cystack.ps redteam) / @mohammedix88