Lucene search

GitHub Advisory DatabaseGHSA-FQHP-RHM6-8RRJ

HistoryJun 21, 2023 - 9:30 p.m.

urlnorm vulnerable to Regular Expression Denial of Service

2023-06-2121:30:25

CWE-1333

GitHub Advisory Database

github.com

urlnorm redos vulnerability rust crate

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

40.9%

JSON

The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to lib.rs.

Affected configurations

Vulners

Node

urlnorm_projecturlnormRange≤0.1.4rust

VendorProductVersionCPE
urlnorm_projecturlnorm*cpe:2.3:a:urlnorm_project:urlnorm:*:*:*:*:*:rust:*:*

Vendor	Product	Version	CPE
urlnorm_project	urlnorm	*	cpe:2.3:a:urlnorm_project:urlnorm::::::rust::*

References

gist.github.com/6en6ar/b118888dc739e8979038f24c8ac33611

github.com/advisories/GHSA-fqhp-rhm6-8rrj

github.com/progscrape/urlnorm

lib.rs/crates/urlnorm

nvd.nist.gov/vuln/detail/CVE-2023-33289

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

40.9%

JSON

Related for GHSA-FQHP-RHM6-8RRJ