PT-2023-28897 · Unknown+2 · Get-Func-Name+2
Gap-Dev
·
Publicado
2023-09-26
·
Atualizado
2023-10-02
·
CVE-2023-43646
CVSS v3.1
8.6
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
get-func-name versions prior to 2.0.1
Description
The issue is related to a regular expression denial of service (redos) vulnerability in the get-func-name module, which can lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, resulting in excessive backtracking and increased CPU load and processing time. The vulnerability can be triggered using a specific input, such as
't'.repeat(54773) + 't/function/i'. The regex implementation in question is susceptible to excessive backtracking, leading to potential DoS attacks.Recommendations
For versions prior to 2.0.1, upgrade to version 2.0.1 or later to address the issue. As a temporary workaround, consider restricting the use of the vulnerable
functionNameMatch regex implementation until a patch is available. Avoid using the functionNameMatch regex with untrusted input until the issue is resolved. At the moment, there are no known workarounds for this vulnerability other than upgrading to a fixed version.Exploit
Correção
DoS
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Astra Linux
Debian
Get-Func-Name