GitHub Advisoryadvisory · Go

GHSA-3f2q-6294-fmq5 Inefficient Regular Expression Complexity in git-urls

HIGH Published 2023-11-18 Modified 2023-11-28 Official page ↗

Aliases: CVE-2023-46402
Ecosystem: Go
Packages: github.com/whilp/git-urls
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-1333
Reviewed: 2023-11-20

Affected packages

• Go github.com/whilp/git-urls: <= 1.0.1 (no fix yet)

Description

git-urls version 1.0.1 is vulnerable to ReDOS (Regular Expression Denial of Service) in Go package.

Related

Alias · CVE (1)

CVE-2023-46402 git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go. vulnerability

Weakness · CWE (1)

CWE-1333 Inefficient Regular Expression Complexity weakness

References