CVE-2022-42966: Inefficient Regular Expression Complexity

November 9, 2022 (updated July 6, 2023)

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method

References

github.com/advisories/GHSA-2p9h-ccw7-33gf
nvd.nist.gov/vuln/detail/CVE-2022-42966
research.jfrog.com/vulnerabilities/cleo-redos-xray-257186/

Detect and mitigate CVE-2022-42966 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →