GHSA-qfh9-8p57-mjjj

git-url-parse crate vulnerable to Regular Expression Denial of Service

Source: GitHub Advisory Database (reviewed) Low CVE-2023-33290

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	git-url-parse	<= 0.4.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to `normalize_url` in `lib.rs`, a similar issue to CVE-2023-32758 (Python).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-33290 advisory
https://github.com/tjtelan/git-url-parse-rs/issues/51 web
https://github.com/tjtelan/git-url-parse-rs package
https://github.com/tjtelan/git-url-parse-rs/blob/main/src/lib.rs#L396 web