CVE-2021-32837

Inefficient Regular Expression Complexity in pypi/mechanize

Identifiers

GHSA-g3pv-pj5f-3hfq, CVE-2021-32837

Package Slug

pypi/mechanize

Vulnerability

Inefficient Regular Expression Complexity

Description

mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to version 0.4.6. If a web server responds in a malicious way, then mechanize could crash. Version 0.4.6 has a patch for the issue.

Affected Versions

All versions before 0.4.6

Solution

Upgrade to version 0.4.6 or above.

Last Modified

2023-01-23

source