PT-2024-30542 · Fugit+1 · Fugit+1

Personnumber3377 · Published 2024-08-19 · Updated 2024-08-23 · CVE-2024-43380

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions fugit versions prior to 1.11.1

Description The fugit "natural" parser, which turns natural language into cron expressions, accepted any length of input and attempted to parse it without returning promptly. This could cause the parse call to hold the thread indefinitely. Fugit dependents that do not check user input length for plausibility are impacted.

Recommendations For fugit versions prior to 1.11.1, update to version 1.11.1 to resolve the issue. As a temporary workaround, ensure that Fugit.parse(s), Fugit.do parse(s), Fugit.parse nat(s), Fugit.do parse nat(s), Fugit::Nat.parse(s), and Fugit::Nat.do parse(s) are not fed strings that are too long, such as limiting input to 1000 characters or less, to prevent the parser from stalling.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-43380

GHSA-2M96-52R3-2F3G

Affected Products

Debian

Fugit

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43380.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fugit/CVE-2024-43380.yml · Exploit
• https://github.com/floraison/fugit/security/advisories/GHSA-2m96-52r3-2f3g · Vendor Advisory
• https://github.com/floraison/fugit/issues/104 · Patch
• https://github.com/floraison/fugit/commit/ad2c1c9c737213d585fff0b51c927d178b2c05a5 · Patch
• https://osv.dev/vulnerability/GHSA-2m96-52r3-2f3g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43380 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-43380 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-43380 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43380 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43380 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-43380 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-43380 · Vendor Advisory
• https://github.com/floraison/fugit · Note
• https://github.com/floraison/fugit/commit/767ef550281bcdc8782233840f98cf8487340476 · Note