PT-2022-24866 · Pypi · Dparse

Yeisonvargasf · Published 2022-09-27 · Updated 2023-07-12 · CVE-2022-39280

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions dparse versions prior to 0.5.2

Description dparse is a parser for Python dependency files. The issue concerns a regular expression that is vulnerable to a Regular Expression Denial of Service (ReDoS). All users parsing index server URLs with dparse are impacted by this issue.

Recommendations For versions prior to 0.5.2, upgrade to version 0.5.2 as soon as possible. For users unable to upgrade, avoid passing index server URLs in the source file to be parsed.

Exploit

Fix

Resource Exhaustion

DoS

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2022-39280

GHSA-8FG9-P83M-X5PQ

PYSEC-2022-301

Affected Products

Dparse

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39280.json · Exploit
• https://github.com/pyupio/dparse/commit/d87364f9db9ab916451b1b036cfeb039e726e614 · Patch
• https://github.com/pyupio/dparse/commit/8c990170bbd6c0cf212f1151e9025486556062d5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39280 · Security Note
• https://osv.dev/vulnerability/GHSA-8fg9-p83m-x5pq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39280 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-301 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/dparse/PYSEC-2022-301.yaml · Note
• https://github.com/pyupio/dparse/security/advisories/GHSA-8fg9-p83m-x5pq · Note
• https://github.com/pyupio/dparse · Note
• https://t.me/cvenotify/37457 · Telegram Post
• https://t.me/cvenotify/54121 · Telegram Post
• https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS · Note