PT-2022-20535 · Rsshub · Rsshub

Rongronggg9 · Published 2022-06-23 · Updated 2023-07-24 · CVE-2022-31110

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions RSSHub versions prior to 5c4177441417

Description The issue arises when special values are passed to the filter and filterout parameters, causing abnormally high CPU usage. This impacts the performance of servers and RSSHub services, potentially leading to a denial of service.

Recommendations For versions prior to 5c4177441417, update to version 5c4177441417 or a later version as soon as possible to resolve the issue. As a temporary workaround, consider restricting the use of the filter and filterout parameters to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

DoS

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2022-31110

GHSA-JVXX-V45P-V5VF

Affected Products

Rsshub

References · 9

• 🔥 https://github.com/DIYgod/RSSHub/issues/10045 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31110.json · Exploit
• https://github.com/DIYgod/RSSHub/security/advisories/GHSA-jvxx-v45p-v5vf · Patch
• https://github.com/DIYgod/RSSHub/commit/5c4177441417b44a6e45c3c63e9eac2504abeb5b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31110 · Security Note
• https://osv.dev/vulnerability/GHSA-jvxx-v45p-v5vf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31110 · Vendor Advisory
• https://github.com/DIYgod/RSSHub/commit/4671720f4c5e1aaaad8fcc1dce684b6546baf2ff · Note
• https://github.com/DIYgod/RSSHub · Note