Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlwcTctcmN4di00N3Zx

Incorrect Regular Expression in RestSharp

RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.

Permalink: https://github.com/advisories/GHSA-9pq7-rcxv-47vq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlwcTctcmN4di00N3Zx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 3 years ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-9pq7-rcxv-47vq, CVE-2021-27293
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-27293
• https://github.com/restsharp/RestSharp/issues/1556
• https://restsharp.dev/
• https://github.com/restsharp/RestSharp/commit/be39346784b68048b230790d15333574341143bc
• https://github.com/advisories/GHSA-9pq7-rcxv-47vq

Repository: https://github.com/restsharp/RestSharp
Blast Radius: 11.8

Affected Packages