RUSTSEC-2021-0041

Denial of service through parsing payloads with too big exponent

Issued
Package
parse_duration (crates.io)
Type
Vulnerability
Categories
  • denial-of-service
Aliases
Details
https://github.com/zeta12ti/parse_duration/issues/21
CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Patched
no patched versions
Keywords
  • parsing
  • untrusted data
Affected Functions
Version
parse_duration::parse
  • *

Description

The parse_duration::parse function allows for parsing duration strings with exponents like 5e5s where under the hood, the BigInt type along with the pow function are used for such payloads. Passing an arbitrarily big exponent makes the parse_duration::parse function to process the payload for a very long time taking up CPU and memory.

This allows an attacker to cause a DoS if the parse_duration::parse function is used to process untrusted input.

More