Ubuntu 22.04 LTS: USN-7040-1 critical: configobj denial of service
ubuntu
September 26, 2024
ConfigObj could be made to crash if it received specially crafted input.
Summary
ConfigObj could be made to crash if it received specially crafted input.
Software Description:
- configobj: simple but powerful config file reader and writer for Python
Details:
It was discovered that ConfigObj contains regex that is susceptible to
catastrophic backtracking. An attacker could possibly use this issue to
cause a regular expression denial of service.
Topics Covered
Update Instructions
The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS python3-configobj 5.0.6-5ubuntu0.1 Ubuntu 20.04 LTS python3-configobj 5.0.6-4ubuntu0.1 Ubuntu 18.04 LTS python-configobj 5.0.6-2ubuntu0.18.04.1~esm1 Available with Ubuntu Pro python3-configobj 5.0.6-2ubuntu0.18.04.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS python-configobj 5.0.6-2ubuntu0.16.04.1~esm1 Available with Ubuntu Pro python3-configobj 5.0.6-2ubuntu0.16.04.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.
References
https://ubuntu.com/security/notices/USN-7040-1
CVE-2023-26112
PREVIOUS
NEXT
Severity
critical
Lowest
Low
Medium
High
Critical
Ubuntu Security Notice USN-7040-1
Topics Covered
Package Information
https://launchpad.net/ubuntu/+source/configobj/5.0.6-5ubuntu0.1
https://launchpad.net/ubuntu/+source/configobj/5.0.6-4ubuntu0.1
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!