Vulnerability Description
The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to lib.rs. NOTE: the Supplier disputes this, taking the position that "Slow printing of URLs is not a CVE."
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Urlnorm Project | Urlnorm | <= 0.1.4 |
Related Weaknesses (CWE)
References
- https://gist.github.com/6en6ar/b118888dc739e8979038f24c8ac33611ExploitThird Party Advisory
- https://github.com/progscrape/urlnormProduct
- https://lib.rs/crates/urlnormProduct
- https://news.ycombinator.com/item?id=40435263
- https://gist.github.com/6en6ar/b118888dc739e8979038f24c8ac33611ExploitThird Party Advisory
- https://github.com/progscrape/urlnormProduct
- https://lib.rs/crates/urlnormProduct
FAQ
What is CVE-2023-33289?
CVE-2023-33289 is a vulnerability with a CVSS score of 7.5 (HIGH). The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to lib.rs. NOTE: the Supplier disputes this, taking the position that "Slow printing of U...
How severe is CVE-2023-33289?
CVE-2023-33289 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-33289?
Check the references section above for vendor advisories and patch information. Affected products include: Urlnorm Project Urlnorm.