Vulnerability in Coala Git-Url-Parse
CVE-2023-32758
giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package.
Vulnerability class: ReDoS (Regular Expression Denial of Service)
EPSS: 0.010 (60.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Coala Git-url-parse
- Semgrep
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Product)
- cve@mitre.org (Product)
- cve@mitre.org (Patch, Issue Tracking)
- cve@mitre.org
- cve@mitre.org
Frequently asked questions
- What is CVE-2023-32758?
- CVE-2023-32758 is a high-severity vulnerability in Coala Git-Url-Parse, classified under Inefficient Regular Expression Complexity. CVSS score: 7.5/10. Published 2023-05-15.
- How severe is CVE-2023-32758?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2023-32758 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.