Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applicatio...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Debian:12 pypy3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 pypy3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 pypy3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:12 python3.11

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-6+deb12u9"}]}]

Debian:13 python3.13

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 python3.13

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.15-1"}]}]

Debian:14 python3.14

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.7-1"}]}]

Debian:14 python3.15

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0~rc1-1"}]}]

参照URL

advisory security-tracker.debian.org