Pygments-2.14.0-py3-none-any.whl: 1 vulnerabilities (highest severity is: 5.5) #16
Description
Vulnerable Library - Pygments-2.14.0-py3-none-any.whl
Pygments is a syntax highlighting package written in Python.
Library home page: https://files.pythonhosted.org/packages/0b/42/d9d95cc461f098f204cd20c85642ae40fbff81f74c300341b8d0e0df14e0/Pygments-2.14.0-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt,/requirements.txt
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (Pygments version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2022-40896 |  Medium |
5.5 | Pygments-2.14.0-py3-none-any.whl | Direct | 2.15.0 | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-40896
Vulnerable Library - Pygments-2.14.0-py3-none-any.whl
Pygments is a syntax highlighting package written in Python.
Library home page: https://files.pythonhosted.org/packages/0b/42/d9d95cc461f098f204cd20c85642ae40fbff81f74c300341b8d0e0df14e0/Pygments-2.14.0-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt,/requirements.txt
Dependency Hierarchy:
- ❌ Pygments-2.14.0-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.
Publish Date: 2023-07-19
URL: CVE-2022-40896
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://pyup.io/vulnerabilities/CVE-2022-40896/58910/
Release Date: 2023-07-19
Fix Resolution: 2.15.0
Step up your Open Source Security Game with Mend here