CVE-2022-42964: Inefficient Regular Expression Complexity

November 9, 2022 (updated July 6, 2023)

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method

References

nvd.nist.gov/vuln/detail/CVE-2022-42964
research.jfrog.com/vulnerabilities/pymatgen-redos-xray-257184/

Code Behaviors & Features

Detect and mitigate CVE-2022-42964 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →