CVE-2021-20270 23.03.21 18:15An infinite loop in SMLLexer in Pygmentsversions 1.5 to 2.7.3 may lead to denial of service when performingsyntax highlighting of a Standard ML (SML) source file, as demonstratedby input that only contains the "exception" keyword.
Upstream version 2.8.1 is not affected.
Because this package would cause 456 dependents to be rebuilt, Iprepared 69e3b7f4bea9ab6c9520c5b5bdc14e0388475c3d and will push soon tostaging once master is merged in it so that .guix-authorizationscontains my key. I also attached the patch (trivial).
Opening this bug to track when this lands into master
From 69e3b7f4bea9ab6c9520c5b5bdc14e0388475c3d Mon Sep 17 00:00:00 2001
Fixes at least CVE-2021-20270.
* gnu/packages/python-xyz.scm (python-pygments): Update to 2.8.1.--- gnu/packages/python-xyz.scm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Toggle diff (23 lines)
diff --git a/gnu/packages/python-xyz.scm b/gnu/packages/python-xyz.scmindex cc21caa721..b50683f943 100644--- a/gnu/packages/python-xyz.scm+++ b/gnu/packages/python-xyz.scm@@ -3619,14 +3619,14 @@ text styles of documentation.") (define-public python-pygments (package (name "python-pygments")- (version "2.7.3")+ (version "2.8.1") (source (origin (method url-fetch) (uri (pypi-uri "Pygments" version)) (sha256 (base32- "05mps9r966r3dpqw6zrs1nlwjdf5y4960hl9m7abwb3qyfnarwyc"))))+ "153zyxigm879sk2n71lfv03y2pgxb7dl0dlsbwkz9aydxnkf2mi6")))) (build-system python-build-system) (arguments ;; FIXME: Tests require sphinx, which depends on this.-- 2.31.0-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEFIvLi9gL+xax3g6RRaix6GvNEKYFAmBad64ACgkQRaix6GvNEKaVKw//SzqEHU4gikv/0O6/sODqx37D6pi/kbQEJKd/7mLbHG1M8VHB9lQNnz9lVKkpeop0q5jWtG1VDdi9bBfT89/kvNmjtgcPk+EMpLVGppLekzY+l0uAX43wgonfpZecjt3Bwx2NVmqwjY9/cxnutV7INKVtbVVPUuUhfNN7i9RLMECDtn/G+ECRsWzTzCbVzhvxmbnGNefbJ0RrVUUuLNq+IyXAP2vhHhDJa5169UUJ1P/Dy/ILe0JV+WEszlewYuxlKEjwNQIUCIRHZaROIXzGChTfayV0sO+b90ub6J44k4w257u7TINaEdXgYNoiUoD6IJ5oPY5CI14EzJQxSUBKFIS+Bf4/A8PHW0N/siHMG0Z9xcwZjvIvgPtz5QF0VrOH3q3xNU3VCL8lRsNXqsTCqXRPctaluPDWv3g2RYQUlPftr8YvMhZd4XoSTkRL/jCa60mTC38y8PjqLskw8buhjaff44PCZ2VGplprsT/vYm8Hy0C/C1D4ISBomseOa6U8HRHfoBVEmd40uTkfMDuw2I1x5JKc130AfHqb3BAvsXyT/KDDtDQrw6u8mc+eqmeesZFfoo+Fkah/08WRhYpOVWfP9zwr9c7bB/2KwzlOvM0CV8KfjvID1liNsWCLnNMLIEMgAklpKx56jhAQx2SxkO6OEqxy2uVof0sKxARqEts==10Ve-----END PGP SIGNATURE-----