CVE-2023-33290 : The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to

The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in lib.rs, a similar issue to CVE-2023-32758 (Python).

Published 2023-06-12 13:15:10

Updated 2023-06-21 16:06:57

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2023-33290

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 25 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-33290

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2023-33290

CWE-1333 Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-33290

https://lib.rs/crates/git-url-parse

git-url-parse — Rust parser // Lib.rs
Product
https://github.com/tjtelan/git-url-parse-rs/issues/51

Security vulnerability in the latest version · Issue #51 · tjtelan/git-url-parse-rs · GitHub
Exploit;Issue Tracking;Third Party Advisory

Products affected by CVE-2023-33290

Git-url-parse Project » Git-url-parse » For Rust
Versions up to, including, (<=) 0.4.4
cpe:2.3:a:git-url-parse_project:git-url-parse:*:*:*:*:*:rust:*:*
Matching versions

Vulnerability Details : CVE-2023-33290

Exploit prediction scoring system (EPSS) score for CVE-2023-33290

CVSS scores for CVE-2023-33290

CWE ids for CVE-2023-33290

References for CVE-2023-33290

Products affected by CVE-2023-33290