CVE-2022-40898 pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)
Remote attackers can cause a denial of service in the Python Wheel library by providing malicious input to the command-line interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-40898?
CVE-2022-40898 is a high-severity denial of service vulnerability in n/a, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.
Weakness: CWE-20
Which versions are affected by CVE-2022-40898?
3 open source packages ship an affected version, including wheel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wheel PyPI | All versions | 0.38.1 |
wheel PyPI | All versions | 0.38.1 |
wheel PyPI | All versions | 0.38.1 |
Linux distribution packages (28)
python3-wheel AlmaLinux:9 | All versions | 1:0.36.2-8.el9 |
python3-wheel-wheel AlmaLinux:9 | All versions | 1:0.36.2-8.el9 |
python-wheel Red Hat:enterprise_linux:9::crb | All versions | 1:0.36.2-8.el9 |
python3-wheel Red Hat:enterprise_linux:9::crb | All versions | 1:0.36.2-8.el9 |
python3-wheel-wheel Red Hat:enterprise_linux:9::crb | All versions | 1:0.36.2-8.el9 |
python-wheel Rocky Linux:9 | All versions | 1:0.36.2-8.el9 |
python-wheel SUSE:Enterprise Storage 6 | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Enterprise Storage 7 | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Enterprise Storage 7.1 | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 0.30.0-2.7.1 |
python-wheel SUSE:Linux Enterprise Module for Public Cloud 15 SP1 | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Manager Proxy 4.2 | All versions | 0.32.3-150100.6.5.1 |
python-wheel SUSE:Manager Server 4.2 | All versions | 0.32.3-150100.6.5.1 |
python-wheel openSUSE:Leap 15.4 | All versions | 0.32.3-150100.6.5.1 |
python-ciscoconfparse openSUSE:Tumbleweed | All versions | 1.7.7-1.1 |
Products include Wheel Project Wheel.
How do I fix CVE-2022-40898?
Upgrade wheel to 0.38.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-40898 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-40898 exists.
Other vulnerabilities in n/a
Sources
Also known as ALSA-2023:6712, AZL-12098, DEBIAN-CVE-2022-40898, GHSA-qwmp-2cf2-g9g6, MGASA-2023-0218, OESA-2023-1904 and 12 more.