GitHub Advisoryadvisory · crates.io

GHSA-qfh9-8p57-mjjj git-url-parse crate vulnerable to Regular Expression Denial of Service

LOW Published 2023-06-12 Modified 2023-06-12 Official page ↗
Aliases
CVE-2023-33290
Ecosystem
crates.io
Packages
git-url-parse
Severity
Low
Weaknesses
CWE-1333
Reviewed
2023-06-12

Affected packages

• crates.io git-url-parse: <= 0.4.4 (no fix yet)

Description

The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to `normalize_url` in `lib.rs`, a similar issue to CVE-2023-32758 (Python).

Related

Alias · CVE (1)

  • CVE-2023-33290 The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References