CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-33290
https://notcve.org/view.php?id=CVE-2023-33290
The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in lib.rs, a similar issue to CVE-2023-32758 (Python). • https://github.com/tjtelan/git-url-parse-rs/issues/51 https://lib.rs/crates/git-url-parse • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-32758
https://notcve.org/view.php?id=CVE-2023-32758
giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package. • https://github.com/coala/git-url-parse/blob/master/giturlparse/parser.py#L53 https://github.com/returntocorp/semgrep/pull/7611 https://github.com/returntocorp/semgrep/pull/7943 https://github.com/returntocorp/semgrep/pull/7955 https://pypi.org/project/git-url-parse • CWE-1333: Inefficient Regular Expression Complexity •