CVE-2021-20270 – This vulnerability in Pygments' SMLLexer causes... (How to Fix)

📋 TL;DR

This vulnerability in Pygments' SMLLexer causes an infinite loop when processing Standard ML source files containing only the 'exception' keyword, leading to denial of service. It affects systems using Pygments versions 1.5 through 2.7.3 for syntax highlighting of SML files. Any application or service that uses vulnerable Pygments versions to highlight SML code is potentially affected.

💻 Affected Systems

Products:

Pygments

Versions: 1.5 to 2.7.3

Operating Systems: All operating systems running Python

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems that process Standard ML (SML) files using Pygments syntax highlighting.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete denial of service for applications using Pygments for SML syntax highlighting, potentially crashing services or consuming all available CPU resources.

🟠

Likely Case

Temporary service disruption or performance degradation when malicious SML input is processed.

🟢

If Mitigated

Minimal impact with proper input validation and updated Pygments version.

🌐 Internet-Facing: MEDIUM - Only affects services that accept and process SML files for syntax highlighting, which is relatively uncommon.

🏢 Internal Only: LOW - Requires specific SML file processing scenarios that are typically limited to development environments.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires submitting a specially crafted SML file containing only the 'exception' keyword to a vulnerable Pygments instance.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.7.4 and later

Vendor Advisory: https://pygments.org/docs/changelog/

Restart Required: No

Instructions:

1. Upgrade Pygments to version 2.7.4 or later using pip: pip install --upgrade pygments>=2.7.4
2. Verify the upgrade completed successfully
3. Test SML syntax highlighting functionality

🔧 Temporary Workarounds

Disable SML highlighting

all

Disable Pygments syntax highlighting for Standard ML files in affected applications

Configure application to skip Pygments processing for .sml files

Input validation

all

Reject SML files containing only the 'exception' keyword before Pygments processing

Add pre-processing filter to check SML file content

🧯 If You Can't Patch

Implement strict input validation to reject SML files with suspicious patterns
Monitor system resources and implement rate limiting for file processing services

🔍 How to Verify

Check if Vulnerable:

Check Pygments version: python -c "import pygments; print(pygments.__version__)" and verify if between 1.5 and 2.7.3

Check Version:

python -c "import pygments; print(pygments.__version__)"

Verify Fix Applied:

Test with a minimal SML file containing only 'exception' keyword and ensure no infinite loop occurs

📡 Detection & Monitoring

Log Indicators:

High CPU usage spikes
Process timeouts when processing SML files
Application crashes during syntax highlighting

Network Indicators:

Repeated SML file uploads to vulnerable endpoints
Unusual traffic patterns to syntax highlighting services

SIEM Query:

source="application.log" AND ("timeout" OR "high cpu" OR "sml") AND process="pygments"

📊 Metadata

CVE ID: CVE-2021-20270

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-835

Published: March 23, 2021

Last Updated: November 21, 2024

🔗 References

https://bugzilla.redhat.com/show_bug.cgi?id=1922136 Issue Tracking,Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html Mailing List,Third Party Advisory
https://www.debian.org/security/2021/dsa-4889 Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Not Applicable,Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1922136 Issue Tracking,Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html Mailing List,Third Party Advisory
https://www.debian.org/security/2021/dsa-4889 Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Not Applicable,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-20270, you might also want to check these: