Bugzilla – Bug 1219313
regexploit has runtime dependency on python2 (/urs/bin/python)
Last modified: 2024-02-08 16:26:47 UTC
> zypper info --requires regexploit Loading repository data... Reading installed packages... Information for package regexploit: ----------------------------------- Repository : Main Repository (OSS) Name : regexploit Version : 1.0.0-1.13 Arch : noarch Vendor : openSUSE Installed Size : 376.5 KiB Installed : No Status : not installed Source package : regexploit-1.0.0-1.13.src Upstream URL : https://github.com/doyensec/regexploit Summary : Find regular expressions vulnerable to ReDoS Description : Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain non-matching input strings can make the regular expression matcher go into crazy backtracking loops and take ages to process. This can cause denial of service, as the CPU will be stuck trying to match the regex. This tool is designed to: * find regular expressions which are vulnerable to ReDoS * give an example malicious string which will cause catastrophic backtracking Supports: - C# - JavaScript/TypeScript (requires node to be installed) - JSON - Python - YAML Requires : [5] /usr/bin/python3 /usr/bin/python /usr/bin/node python(abi) = 3.11 python3-base >= 3.8 the dependency on /usr/bin/python should be eliminated (port all scripts to python3)
Most scripts have a fix shebanh - except this one: /usr/lib/python3.11/site-packages/regexploit/bin/regexploit-python-env:#!/usr/bin/python
https://build.opensuse.org/request/show/1143291
(In reply to Sebastian Wagner from comment #2) > https://build.opensuse.org/request/show/1143291 accepted => fixed