Bug 28982

This SRPM has been maintained by various people, so assigning this bug globally. CC'ing Philippe, registered maintainer.

Assignee: bugsquad => pkg-bugs
CC: (none) => makowski.mageia

Forgot there was a Python group, changing assignment from everybody to them.

Assignee: pkg-bugs => python

Fedora has issued an advisory for this on May 6:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GSJRFHALQ7E3UV4FFMFU2YQ6LUDHAI55/

Done for mga7 adding debian's patch!

CC: (none) => geiger.david68210

RPMS:
python2-pygments-2.3.1-1.2.mga7
python3-pygments-2.3.1-1.2.mga7

from python-pygments-2.3.1-1.2.mga7.src.rpm

Status comment: Patch available from Debian => (none)
Assignee: python => qa-bugs

mga7, x86_64

CVE-2021-27291 has been assigned for a possible regular express DOS attack vulnerability.  No details found.
Updated the packages.

Following the condensed tutorial from bug 28319 to test this.

$ cat test.py
from pygments import highlight
from pygments.lexers import PythonLexer
from pygments.formatters import HtmlFormatter

code = 'print "Hello World"'
print(highlight(code, PythonLexer(), HtmlFormatter()))

$ python2 test.py
<div class="highlight"><pre><span></span><span class="k">print</span> <span class="s2">&quot;Hello World&quot;</span>
</pre></div>

Running test.py with python3 generated the same code.

$ pygmentize -f html -o test.html test.py
$ firefox file:./test2.html
This printed the content of test.py in a new browser page.
$ cat test2.html
<div class="highlight"><pre><span></span><span class="kn">from</span> <span class="nn">pygments</span> <span class="kn">import</span> <span class="n">highlight</span>
<span class="kn">from</span> <span class="nn">pygments.lexers</span> <span class="kn">import</span> <span class="n">PythonLexer</span>
<span class="kn">from</span> <span class="nn">pygments.formatters</span> <span class="kn">import</span> <span class="n">HtmlFormatter</span>

<span class="n">code</span> <span class="o">=</span> <span class="s1">&#39;print &quot;Hello World&quot;&#39;</span>
<span class="k">print</span><span class="p">(</span><span class="n">highlight</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">PythonLexer</span><span class="p">(),</span> <span class="n">HtmlFormatter</span><span class="p">()))</span>
</pre></div>

$ pygmentize -f html -O full -o style.html test.py
$ firefox file:./style.html
This showed the same code in a browser withblue, red and green highlighting,
green for python reserved words, blue for package names and red for quoted text.

$ pygmentize -S default -f html > style.css
creates a cascading style sheet, which I don't know how to use but which assigns different colours for elements of the code.
$ pygmentize-3 -S default -f html > style3.css
does the same for python3 and the content appears to be the same.

This looks good to go.

CC: (none) => tarazed25
Whiteboard: (none) => MGA7-64-OK

Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Advisory:
========================

Updated python-pygments packages fix a security vulnerability:

In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service (CVE-2021-27291).

References:
 - https://bugs.mageia.org/show_bug.cgi?id=28982
 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27291
 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GSJRFHALQ7E3UV4FFMFU2YQ6LUDHAI55/
========================

Updated packages in 7/core/updates_testing:
========================
python2-pygments-2.3.1-1.2.mga7
python3-pygments-2.3.1-1.2.mga7

from python-pygments-2.3.1-1.2.mga7.src.rpm

CVE: (none) => CVE-2021-27291
Keywords: (none) => advisory
CC: (none) => ouaurelien

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0245.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED