Regular Expression Denial of Service in git-url-parse for Rust
CVE-2023-33290

7.5HIGH

Key Information:

Vendor: Git-url-parse Project
Status: Git-url-parse
Vendor: CVE Published:; 12 June 2023

🔔 Create Git-url-parse Project Vulnerability Alert

What is CVE-2023-33290?

The git-url-parse crate for Rust, specifically versions up to 0.4.4, is susceptible to a Regular Expression Denial of Service (ReDos) attack. By supplying a specially crafted URL, attackers can exploit the normalization function in lib.rs, leading to potential service disruptions. This vulnerability is reminiscent of similar issues found in other programming languages, such as Python's CVE-2023-32758.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://lib.rs/crates/git-url-parse

https://github.com/tjtelan/git-url-parse-rs/issues/51

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Jun 12, 2023
Vulnerability Reserved
May 22, 2023

JSON

Git-url-parse Project

What is CVE-2023-33290?

Human OS v1.0: Ageing Is an Unpatched Zero-Day Vulnerability.

References

CVSS V3.1

Timeline

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.