PT-2022-20527 · Rulex · Rulex

Evan Richter · Published 2022-05-21 · Updated 2022-07-11 · CVE-2022-31100

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions rulex versions prior to 0.4.3

Description When parsing untrusted rulex expressions, rulex may crash, possibly enabling a Denial of Service attack. This happens when the expression contains a multi-byte UTF-8 code point in a string literal or after a backslash, because rulex tries to slice into the code point and panics as a result. This is a security concern for services that parse untrusted rulex expressions and become unavailable when the thread running rulex panics.

Recommendations Update to version 0.4.3 to fix the issue. As a temporary workaround, consider using catch unwind to recover from panics or assume that regular expression parsing will panic and add logic to catch panics.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2022-31100

GHSA-8V9W-P43C-R885

RUSTSEC-2022-0031

Affected Products

Rulex

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31100.json · Exploit
• https://github.com/rulex-rs/rulex/commit/fac6d58b25c6f9f8c0a6cdc4dec75b37b219f1d6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31100 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31100 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2022-0031 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8v9w-p43c-r885 · Vendor Advisory
• https://github.com/rulex-rs/rulex · Note
• https://github.com/rulex-rs/rulex/security/advisories/GHSA-8v9w-p43c-r885 · Note
• https://crates.io/crates/rulex · Note
• https://t.me/cvenotify/32881 · Telegram Post
• https://t.me/cibsecurity/45258 · Telegram Post
• https://rustsec.org/advisories/RUSTSEC-2022-0031.html · Note