cleo is vulnerable to Regular Expression Denial of Service (ReDoS)

高危 7.5CVE-2022-42966 · GHSA-2p9h-ccw7-33gf · PYSEC-2022-43178 · Published 09/11/2022 · updated 17/06/2026

要点

CVE-2022-42966 是影响 cleo, cleo (python-poetry) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.99%，高于 62.7% 的漏洞。
修复：升级到 2.0.0 或更高版本。

Package	Affected versions	Patched versions
cleo PyPI	`≥ 1.0.0a1, < 2.0.0< 2.0.0`	`2.0.0`
cleo python-poetry	`< 2.0.0`	`2.0.0`

Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method.

NVD description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method

References

nvd.nist.gov/vuln/detail/CVE-2022-42966 · ADVISORY
python-poetry/cleo#285 · WEB
python-poetry/cleo commit b5b9a04 · WEB
GitHub Advisory GHSA-2p9h-ccw7-33gf · ADVISORY
pypa/advisory-database · WEB
python-poetry/cleo · PACKAGE
python-poetry/cleo release 2.0.0 · WEB
research.jfrog.com/vulnerabilities/cleo-redos-xray-257186 · WEB
research.jfrog.com/vulnerabilities/cleo-redos-xray-257186 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free