GHSA-v78m-2q7v-fjqp

Suggest an improvement
Source
https://github.com/advisories/GHSA-v78m-2q7v-fjqp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-v78m-2q7v-fjqp/GHSA-v78m-2q7v-fjqp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-v78m-2q7v-fjqp
Aliases
Published
2022-06-22T17:52:51Z
Modified
2023-11-08T04:09:25Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Uncontrolled Recursion in rulex
Details

Impact

When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately.

This is a security concern for you, if

  • your service parses untrusted rulex expressions (expressions provided by an untrusted user), and
  • your service becomes unavailable when the process running rulex aborts due to a stack overflow.

Patches

The crash is fixed in version 0.4.3. Affected users are advised to update to this version.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

Credits

Credit for finding these bugs goes to

Database specific 
{
    "cwe_ids":  [
        "CWE-674"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-06-22T17:52:51Z",
    "nvd_published_at":  "2022-06-27T23:15:00Z",
    "severity":  "MODERATE"
}
References

Affected packages

crates.io / rulex

Package

Name
rulex
View open source insights on deps.dev
Purl
pkg:cargo/rulex

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.4.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-v78m-2q7v-fjqp/GHSA-v78m-2q7v-fjqp.json"