PT-2023-24272 · Unknown · Giturlparse

Published 2023-06-12 · Updated 2023-06-21 · CVE-2023-33290

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions git-url-parse versions 0.4.4 and earlier

Description The issue allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize url in lib.rs. This is similar to an issue found in Python.

Recommendations For versions 0.4.4 and earlier, consider disabling the normalize url function in lib.rs until a patch is available. Restrict access to crafted URLs to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2023-33290

GHSA-QFH9-8P57-MJJJ

Affected Products

Giturlparse

References · 8

• 🔥 https://github.com/tjtelan/git-url-parse-rs/issues/51 · Exploit
• https://osv.dev/vulnerability/GHSA-qfh9-8p57-mjjj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33290 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33290 · Vendor Advisory
• https://github.com/tjtelan/git-url-parse-rs · Note
• https://github.com/tjtelan/git-url-parse-rs/blob/main/src/lib.rs#L396 · Note
• https://lib.rs/crates/git-url-parse · Note
• https://t.me/cvenotify/52790 · Telegram Post