Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xZmg5LThwNTctbWpqas4AAzx5

git-url-parse crate vulnerable to Regular Expression Denial of Service

The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in lib.rs, a similar issue to CVE-2023-32758 (Python).

Permalink: https://github.com/advisories/GHSA-qfh9-8p57-mjjj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xZmg5LThwNTctbWpqas4AAzx5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: 11 months ago
Updated: 6 months ago

Identifiers: GHSA-qfh9-8p57-mjjj, CVE-2023-33290
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-33290
• https://github.com/tjtelan/git-url-parse-rs/issues/51
• https://github.com/tjtelan/git-url-parse-rs/blob/main/src/lib.rs#L396
• https://github.com/advisories/GHSA-qfh9-8p57-mjjj

Repository: https://github.com/tjtelan/git-url-parse-rs
Blast Radius: 0.0

Affected Packages