Description (CNA)
Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. extract_full_summary_from_signature employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)" that is susceptible to catastrophic backtracking when processing crafted docstrings containing a large volume of whitespace without a terminating colon. An attacker who can control or inject docstring content into affected applications can trigger excessive CPU consumption. This software is used by Azure CLI.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Microsoft / Knack | affected 0.12.0 |
CWE
CWE-1333
References
- https://github.com/microsoft/knack
- https://www.vulncheck.com/advisories/microsoft-knack-python-package-regular-expression-dos
- https://github.com/microsoft/knack/issues/281
ADP enrichment
No English description supplied.
No references supplied.