Security update for python-Pygments SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:3840-1 Final 1 1 2021-12-01T15:11:34Z current 2021-12-01T15:11:34Z 2021-12-01T15:11:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-Pygments This update for python-Pygments fixes the following issues: - CVE-2021-27291: Fixed ReDoS via crafted malicious input (bsc#1184812). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP1-Azure-BYOS-2021-3840,Image SLES15-SP1-Azure-HPC-BYOS-2021-3840,Image SLES15-SP1-SAP-Azure-2021-3840,Image SLES15-SP1-SAP-Azure-BYOS-2021-3840,Image SLES15-SP1-SAPCAL-Azure-2021-3840,Image SLES15-SP2-BYOS-Azure-2021-3840,Image SLES15-SP2-HPC-BYOS-Azure-2021-3840,Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure-2021-3840,Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure-2021-3840,Image SLES15-SP2-SAP-Azure-2021-3840,Image SLES15-SP2-SAP-BYOS-Azure-2021-3840,SUSE-2021-3840,SUSE-SLE-Module-Basesystem-15-SP2-2021-3840,SUSE-SLE-Product-HPC-15-SP1-ESPOS-2021-3840,SUSE-SLE-Product-HPC-15-SP1-LTSS-2021-3840,SUSE-SLE-Product-SLES-15-SP1-BCL-2021-3840,SUSE-SLE-Product-SLES-15-SP1-LTSS-2021-3840,SUSE-SLE-Product-SLES_SAP-15-SP1-2021-3840,SUSE-Storage-6-2021-3840 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20213840-1/ Link for SUSE-SU-2021:3840-1 https://lists.suse.com/pipermail/sle-security-updates/2021-December/009782.html E-Mail link for SUSE-SU-2021:3840-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1184812 SUSE Bug 1184812 https://www.suse.com/security/cve/CVE-2021-27291/ SUSE CVE CVE-2021-27291 page Image SLES15-SP1-Azure-BYOS Image SLES15-SP1-Azure-HPC-BYOS Image SLES15-SP1-SAP-Azure Image SLES15-SP1-SAP-Azure-BYOS Image SLES15-SP1-SAPCAL-Azure Image SLES15-SP2-BYOS-Azure Image SLES15-SP2-HPC-BYOS-Azure Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure Image SLES15-SP2-SAP-Azure Image SLES15-SP2-SAP-BYOS-Azure SUSE Enterprise Storage 6 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Server 15 SP1-BCL SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP1 python3-Pygments-2.6.1-7.10.1 python3-Pygments-2.6.1-7.10.1 as a component of Image SLES15-SP1-Azure-BYOS python3-Pygments-2.6.1-7.10.1 as a component of Image SLES15-SP1-Azure-HPC-BYOS python3-Pygments-2.6.1-7.10.1 as a component of Image SLES15-SP1-SAP-Azure python3-Pygments-2.6.1-7.10.1 as a component of Image SLES15-SP1-SAP-Azure-BYOS python3-Pygments-2.6.1-7.10.1 as a component of Image SLES15-SP1-SAPCAL-Azure python3-Pygments-2.6.1-7.10.1 as a component of Image SLES15-SP2-BYOS-Azure python3-Pygments-2.6.1-7.10.1 as a component of Image SLES15-SP2-HPC-BYOS-Azure python3-Pygments-2.6.1-7.10.1 as a component of Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure python3-Pygments-2.6.1-7.10.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure python3-Pygments-2.6.1-7.10.1 as a component of Image SLES15-SP2-SAP-Azure python3-Pygments-2.6.1-7.10.1 as a component of Image SLES15-SP2-SAP-BYOS-Azure python3-Pygments-2.6.1-7.10.1 as a component of SUSE Enterprise Storage 6 python3-Pygments-2.6.1-7.10.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS python3-Pygments-2.6.1-7.10.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS python3-Pygments-2.6.1-7.10.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 python3-Pygments-2.6.1-7.10.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL python3-Pygments-2.6.1-7.10.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS python3-Pygments-2.6.1-7.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service. CVE-2021-27291 Image SLES15-SP1-Azure-BYOS:python3-Pygments-2.6.1-7.10.1 Image SLES15-SP1-Azure-HPC-BYOS:python3-Pygments-2.6.1-7.10.1 Image SLES15-SP1-SAP-Azure-BYOS:python3-Pygments-2.6.1-7.10.1 Image SLES15-SP1-SAP-Azure:python3-Pygments-2.6.1-7.10.1 Image SLES15-SP1-SAPCAL-Azure:python3-Pygments-2.6.1-7.10.1 Image SLES15-SP2-BYOS-Azure:python3-Pygments-2.6.1-7.10.1 Image SLES15-SP2-HPC-BYOS-Azure:python3-Pygments-2.6.1-7.10.1 Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure:python3-Pygments-2.6.1-7.10.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:python3-Pygments-2.6.1-7.10.1 Image SLES15-SP2-SAP-Azure:python3-Pygments-2.6.1-7.10.1 Image SLES15-SP2-SAP-BYOS-Azure:python3-Pygments-2.6.1-7.10.1 SUSE Enterprise Storage 6:python3-Pygments-2.6.1-7.10.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:python3-Pygments-2.6.1-7.10.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:python3-Pygments-2.6.1-7.10.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:python3-Pygments-2.6.1-7.10.1 SUSE Linux Enterprise Server 15 SP1-BCL:python3-Pygments-2.6.1-7.10.1 SUSE Linux Enterprise Server 15 SP1-LTSS:python3-Pygments-2.6.1-7.10.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:python3-Pygments-2.6.1-7.10.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213840-1/ https://www.suse.com/security/cve/CVE-2021-27291.html CVE-2021-27291 https://bugzilla.suse.com/1184812 SUSE Bug 1184812