Regular Expression Denial of Service in git-url-parse for Rust
CVE-2023-33290

7.5HIGH

Key Information:

Vendor
Git-url-parse Project
Status
Git-url-parse
Vendor
CVE Published:
12 June 2023

Summary

The git-url-parse crate for Rust, specifically versions up to 0.4.4, is susceptible to a Regular Expression Denial of Service (ReDos) attack. By supplying a specially crafted URL, attackers can exploit the normalization function in lib.rs, leading to potential service disruptions. This vulnerability is reminiscent of similar issues found in other programming languages, such as Python's CVE-2023-32758.

References

https://lib.rs/crates/git-url-parse
https://github.com/tjtelan/git-url-parse-rs/issues/51

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.