Rasmus Petersen

**Name of the Vulnerable Software and Affected Versions** mechanize versions prior to 0.4.6 **Description** The mechanize library, used for automatically interacting with HTTP web servers, contains a regular expression vulnerable to regular expression denial of service (ReDoS). If a web server responds maliciously, mechanize could crash. **Recommendations** For versions prior to 0.4.6, update to version 0.4.6 to resolve the issue. As a temporary workaround, consider restricting interactions with potentially malicious web servers until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** Zulip versions prior to 4.7 **Description** Zulip is an open source team chat server that allows organization administrators to configure linkifiers, which automatically create links from messages sent by users, detected via arbitrary regular expressions. Malicious organization administrators could subject the server to a denial-of-service via regular expression complexity attacks by configuring a quadratic-time regular expression in a linkifier and sending messages that exploited it. The regular expression attempted to parse user-provided regexes to verify they were safe from ReDoS, but this was insufficient and itself subject to ReDoS if the organization administrator entered a sufficiently complex invalid regex. **Recommendations** For versions prior to 4.7, upgrade to the just-released Zulip 4.7 or switch to the `main` branch to resolve the issue. As a temporary workaround, consider restricting the ability of organization administrators to configure linkifiers until the upgrade is applied.

**Name of the Vulnerable Software and Affected Versions** Apprise versions prior to 0.9.5.1 **Description** The issue affects users of Apprise who have granted access to the IFTTT plugin, making them subject to a denial of service attack due to an inefficient regular expression. The vulnerable regular expression is located in the NotifyIFTTT.py file. This issue has been patched in release version 0.9.5.1. **Recommendations** For versions prior to 0.9.5.1, update to Apprise v0.9.5.1 by running `pip install apprise==0.9.5.1`. As a temporary workaround for users unable to upgrade, consider removing the `apprise/plugins/NotifyIFTTT.py` file to eliminate the vulnerable service, although this will disable IFTTT notification functionality.