CVE-2023-32758

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-32758
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32758.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-32758
Aliases
Published
2023-05-15T00:00:00Z
Modified
2026-07-08T07:34:22.487114191Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32758.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/coala/git-url-parse

Affected ranges

Type
GIT
Repo
https://github.com/coala/git-url-parse
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a5b7db9f7509faedb740ce55fc9dc100d0dd0e83
Database specific 
{
    "source": [
        "DESCRIPTION",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:coala:git-url-parse:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.2.2"
        },
        {
            "last_affected": "1.2.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/semgrep/semgrep
Events
Introduced
be930f6c55d4999d7d4bc71dff2771be6536f831
Fixed
ed1f1700c3d855396d91ef904916b0bdd3aece17
Database specific 
{
    "source": "DESCRIPTION",
    "extracted_events": [
        {
            "introduced": "1.5.2"
        },
        {
            "fixed": "1.24.1"
        }
    ]
}

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.1
1.2.0
1.2.1
1.5.2
1.5.3
1.5.4
1.5.5
ast_generic_1.*
ast_generic_1.8.0
ast_generic_full_1.*
ast_generic_full_1.8.0
commons_1.*
commons_1.8.0
lib_parsing_1.*
lib_parsing_1.5.5
profiling_1.*
profiling_1.5.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32758.json"