CVE-2020-28493

Regular Expression Denial of Service (ReDoS)

Medium · published February 1, 2021

CVSS v3.1
5.3
EPSS
4%
Percentile
89.3
In the wild
Unconfirmed
What it is

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
CVSS v4.0
Not supplied
EPSS
0.03546 · 89.3th percentile
Published
2021-02-01T19:30Z
EPSS history
Timeline
  • 01 FEB 19:30Z
    Regular Expression Denial of Service (ReDoS)
    cvelistv5