GitHub Advisoryadvisory · crates.io

GHSA-qpgv-g792-wh6x Uncontrolled Resource Consumption in parse_duration

HIGH Published 2021-08-25 Modified 2021-08-19 Official page ↗
Aliases
CVE-2021-29932
Ecosystem
crates.io
Packages
parse_duration
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-08-19

Affected packages

• crates.io parse_duration: <= 2.1.1 (no fix yet)

Description

An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption) via a duration string with a large exponent.

Related

Alias · CVE (1)

  • CVE-2021-29932 An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References