CVE-2023-26112 configobj ReDoS exploitable by developer using values in a server-side configuration file
A Regular Expression Denial of Service vulnerability in the configobj library allows attackers to cause service disruption via malicious configuration values.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-26112?
CVE-2023-26112 is a low-severity denial of service vulnerability in configobj, published on 3 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.
Weakness: CWE-1333
Which versions are affected by CVE-2023-26112?
3 open source packages ship an affected version, including configobj. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
configobj PyPI | All versions | 5.0.9 |
configobj PyPI | All versions | 5.0.9 |
configobj PyPI | All versions | 5.0.9 |
Linux distribution packages (13)
python-configobj SUSE:Linux Enterprise Micro 5.4 | All versions | 5.0.6-150000.3.3.1 |
python-configobj SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 5.0.6-150000.3.3.1 |
python-configobj SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 5.0.6-150000.3.3.1 |
python-configobj SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 5.0.6-20.8.1 |
python-configobj SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 5.0.6-150000.3.3.1 |
python-configobj SUSE:Linux Enterprise Server 12 SP5 | All versions | 5.0.6-20.8.1 |
python-configobj SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 5.0.6-20.8.1 |
python-configobj SUSE:Manager Proxy 4.2 | All versions | 5.0.6-150000.3.3.1 |
python-configobj SUSE:Manager Server 4.2 | All versions | 5.0.6-150000.3.3.1 |
python-configobj openSUSE:Leap 15.4 | All versions | 5.0.6-150000.3.3.1 |
python-configobj openSUSE:Leap 15.5 | All versions | 5.0.6-150000.3.3.1 |
python-configobj openSUSE:Leap Micro 5.4 | All versions | 5.0.6-150000.3.3.1 |
python-configobj openSUSE:Tumbleweed | All versions | 5.0.9-1.6 |
Products include Configobj Project Configobj.
How do I fix CVE-2023-26112?
Upgrade configobj to 5.0.9 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-26112 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26112 exists.
Sources
Also known as DEBIAN-CVE-2023-26112, GHSA-c33w-24p9-8m24, MINI-4hc4-rchx-5f9j, PYSEC-2026-1270, SUSE-SU-2023:3368-1, SUSE-SU-2023:3369-1 and 5 more.