CVE-2023-26112

Name	CVE-2023-26112
Description	All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.)\). Note:* This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1034152

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
configobj (PTS)	bullseye	5.0.6-4	vulnerable
	bookworm	5.0.8-1	vulnerable
	sid, trixie	5.0.9-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
configobj	source	(unstable)	5.0.8-2	unimportant		1034152

Notes

https://security.snyk.io/vuln/SNYK-PYTHON-CONFIGOBJ-3252494
https://github.com/DiffSK/configobj/issues/232
https://github.com/DiffSK/configobj/pull/236
Negligible security impact