giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package.
References
Configurations
Configuration 1 (hide)
| AND |
|
History
09 Jun 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 Jun 2023, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package. |
26 May 2023, 18:53
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Coala git-url-parse
Coala Semgrep Semgrep semgrep |
|
| References | (MISC) https://github.com/returntocorp/semgrep/pull/7611 - Issue Tracking, Patch | |
| References | (MISC) https://pypi.org/project/git-url-parse - Product | |
| References | (MISC) https://github.com/coala/git-url-parse/blob/master/giturlparse/parser.py#L53 - Product | |
| CWE | CWE-1333 | |
| CPE | cpe:2.3:a:semgrep:semgrep:*:*:*:*:*:*:*:* cpe:2.3:a:coala:git-url-parse:*:*:*:*:*:*:*:* |
Information
Published : 2023-05-15 04:15
Updated : 2024-02-28 20:13
NVD link : CVE-2023-32758
Mitre link : CVE-2023-32758
CVE.ORG link : CVE-2023-32758
JSON object : View
Products Affected
coala
- git-url-parse
semgrep
- semgrep
CWE
CWE-1333
Inefficient Regular Expression Complexity