CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-33290
https://notcve.org/view.php?id=CVE-2023-33290
12 Jun 2023 — The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in lib.rs, a similar issue to CVE-2023-32758 (Python). • https://github.com/tjtelan/git-url-parse-rs/issues/51 • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-32758
https://notcve.org/view.php?id=CVE-2023-32758
15 May 2023 — giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package. • https://github.com/coala/git-url-parse/blob/master/giturlparse/parser.py#L53 • CWE-1333: Inefficient Regular Expression Complexity •