Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS12NzhtLTJxN3YtZmpxcM4AAs6y
Uncontrolled Recursion in rulex
Impact
When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately.
This is a security concern for you, if
- your service parses untrusted rulex expressions (expressions provided by an untrusted user), and
- your service becomes unavailable when the process running rulex aborts due to a stack overflow.
Patches
The crash is fixed in version 0.4.3. Affected users are advised to update to this version.
Workarounds
None.
For more information
If you have any questions or comments about this advisory:
- Open an issue in rulex
- Email me at [email protected]
Credits
Credit for finding these bugs goes to
Permalink: https://github.com/advisories/GHSA-v78m-2q7v-fjqpJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NzhtLTJxN3YtZmpxcM4AAs6y
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago
CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Identifiers: GHSA-v78m-2q7v-fjqp, CVE-2022-31099
References:
- https://github.com/rulex-rs/rulex/security/advisories/GHSA-v78m-2q7v-fjqp
- https://github.com/rulex-rs/rulex/commit/60aa2dc03a22d69c8800fec81f99c96958a11363
- https://nvd.nist.gov/vuln/detail/CVE-2022-31099
- https://rustsec.org/advisories/RUSTSEC-2022-0030.html
- https://github.com/advisories/GHSA-v78m-2q7v-fjqp
Blast Radius: 1.0
Affected Packages
cargo:rulex
Dependent packages: 2Dependent repositories: 0
Downloads: 2,987 total
Affected Version Ranges: < 0.4.3
Fixed in: 0.4.3
All affected versions: 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.4.1, 0.4.2
All unaffected versions: 0.4.3, 0.4.4