Mako-1.1.4-py2.py3-none-any.whl: 1 vulnerabilities (highest severity is: 7.5)

[mend-for-github-com]

Vulnerable Library - Mako-1.1.4-py2.py3-none-any.whl

A super-fast templating language that borrows the best ideas from the existing templating languages.

Library home page: https://files.pythonhosted.org/packages/f3/54/dbc07fbb20865d3b78fdb7cf7fa713e2cba4f87f71100074ef2dc9f9d1f7/Mako-1.1.4-py2.py3-none-any.whl

Path to dependency file: /data-files/benchmarks/bm_mako/requirements.txt

Path to vulnerable library: /data-files/benchmarks/bm_mako/requirements.txt

Found in HEAD commit: b4e24341e4c07ef7401fadd16a39617d287a4d1e

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (Mako version)	Remediation Possible**
CVE-2022-40023	High	7.5	Mako-1.1.4-py2.py3-none-any.whl	Direct	Mako - 1.2.2	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-40023

Vulnerable Library - Mako-1.1.4-py2.py3-none-any.whl

A super-fast templating language that borrows the best ideas from the existing templating languages.

Library home page: https://files.pythonhosted.org/packages/f3/54/dbc07fbb20865d3b78fdb7cf7fa713e2cba4f87f71100074ef2dc9f9d1f7/Mako-1.1.4-py2.py3-none-any.whl

Path to dependency file: /data-files/benchmarks/bm_mako/requirements.txt

Path to vulnerable library: /data-files/benchmarks/bm_mako/requirements.txt

Dependency Hierarchy:

• ❌ Mako-1.1.4-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b4e24341e4c07ef7401fadd16a39617d287a4d1e

Found in base branch: main

Vulnerability Details

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

Publish Date: 2022-09-07

URL: CVE-2022-40023

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-09-07

Fix Resolution: Mako - 1.2.2

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.