PT-2023-24006 · Unknown+1 · Giturlparse+1

Martin Jambon + 1 · Published 2023-05-15 · Updated 2025-01-23 · CVE-2023-32758

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions giturlparse versions through 1.2.2 Semgrep versions 1.5.2 through 1.24.1

Description The issue is related to ReDoS (Regular Expression Denial of Service) when parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package, and that package's author placed a ReDoS attack payload in a URL used by the package.

Recommendations For giturlparse versions through 1.2.2, update to a version that fixes the ReDoS vulnerability. For Semgrep versions 1.5.2 through 1.24.1, update to a version that uses a fixed version of giturlparse. As a temporary workaround, consider restricting the analysis of untrusted packages in Semgrep until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2023-32758

GHSA-4XQQ-73WG-5MJP

Affected Products

Semgrep

Giturlparse

References · 13

• https://github.com/returntocorp/semgrep/pull/7611 · Patch
• https://osv.dev/vulnerability/GHSA-4xqq-73wg-5mjp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32758 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32758 · Vendor Advisory
• https://github.com/returntocorp/semgrep/pull/7943 · Note
• https://github.com/returntocorp/semgrep/pull/7955 · Note
• https://github.com/coala/git-url-parse · Note
• https://github.com/coala/git-url-parse/blob/master/giturlparse/parser.py#L53 · Note
• https://pypi.org/project/git-url-parse · Note
• https://t.me/cvenotify/108418 · Telegram Post
• https://t.me/cvenotify/50411 · Telegram Post
• https://t.me/cvenotify/52790 · Telegram Post
• https://t.me/cibsecurity/64078 · Telegram Post