Skip to main content

Inefficient Regular Expression Complexity

CVE-2020-6817

High
7.5/10

Summary

In mozilla-bleach prior to version 3.1.4, the "bleach.clean" behavior parsing style attributes could result in a Regular expression Denial of Service (ReDoS). Calls to "bleach.clean" with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, "bleach.clean(..., attributes={'a': ['style']})".

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

Advisory Timeline

  • Published