PT-2021-18545 · Unknown · Parse Duration

Published 2021-03-18 · Updated 2022-07-12 · CVE-2021-29932

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions parse duration crate versions through 2021-03-18

Description The issue allows attackers to cause a denial of service (CPU and memory consumption) via a duration string with a large exponent. This is possible because the parse duration::parse function uses the BigInt type along with the pow function to parse duration strings with exponents. Passing an arbitrarily big exponent makes the function process the payload for a very long time, taking up CPU and memory. This can be exploited to cause a denial of service if the function is used to process untrusted input.

Recommendations For versions through 2021-03-18, consider disabling the parse duration::parse function until a patch is available to prevent denial of service attacks via large exponent duration strings. Restrict access to untrusted input to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CAN-2021-1000007

CVE-2021-29932

GHSA-QPGV-G792-WH6X

RUSTSEC-2021-0041

Affected Products

Parse Duration

References · 10

• https://rustsec.org/advisories/RUSTSEC-2021-0041.html · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0041 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29932 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qpgv-g792-wh6x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29932 · Security Note
• https://github.com/zeta12ti/parse_duration/issues/21 · Note
• https://github.com/zeta12ti/parse_duration · Note
• https://t.me/cvenotify/12661 · Telegram Post
• https://t.me/cvenotify/12458 · Telegram Post
• https://crates.io/crates/parse_duration · Note