CVE-2023-52425 (High) detected in cpythonv2.7.16

[mend-bolt-for-github]

CVE-2023-52425 - High Severity Vulnerability

Vulnerable Library - cpythonv2.7.16

The Python programming language

Library home page: https://github.com/python/cpython.git

Found in HEAD commit: d66bab0185eec39df594e7dd54efcc63217f186e

Found in base branch: master

Vulnerable Source Files (1)

/node_modules/gatsby-plugin-sharp/node_modules/sharp/vendor/include/expat.h

Vulnerability Details

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

Publish Date: 2024-02-04

URL: CVE-2023-52425

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with Mend here