- Reported
-
- Issued
-
- Package
-
parse_duration
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#parsing
#untrusted-data
- Aliases
-
- References
-
- CVSS Score
- 7.5
HIGH
- CVSS Details
-
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Patched
-
no patched versions
- Affected Functions
- Version
parse_duration::parse-
Description
The parse_duration::parse function allows for parsing duration strings with exponents like 5e5s where under the hood, the BigInt type along with the pow function are used for such payloads. Passing an arbitrarily big exponent makes the parse_duration::parse function to process the payload for a very long time taking up CPU and memory.
This allows an attacker to cause a DoS if the parse_duration::parse function is used to process untrusted input.
Advisory available under CC0-1.0
license.