HistoryEdit

RUSTSEC-2021-0041

Denial of service through parsing payloads with too big exponent

Issued
Package
parse_duration (crates.io)
Type
Vulnerability
Categories
Keywords
#parsing #untrusted-data
Aliases
Details
https://github.com/zeta12ti/parse_duration/issues/21
CVSS Score
7.5 HIGH
CVSS Details
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Patched
no patched versions
Keywords
#parsing #untrusted-data
Affected Functions
Version
parse_duration::parse
  • *

Description

The parse_duration::parse function allows for parsing duration strings with exponents like 5e5s where under the hood, the BigInt type along with the pow function are used for such payloads. Passing an arbitrarily big exponent makes the parse_duration::parse function to process the payload for a very long time taking up CPU and memory.

This allows an attacker to cause a DoS if the parse_duration::parse function is used to process untrusted input.