CVE-2022-21195: Regular expression denial of service in url_regex
Summary
CVE-2022-21195: Regular expression denial of service in url_regex. Affects url-regex versions < 1.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'url-regex' package is an open-source Python package available on PyPI. It provides regular expressions for matching URLs in strings. This package is commonly used in web development and data processing applications. However, all versions of the 'url-regex' package are vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability can lead to excessive CPU usage and potentially crash the system.
Vulnerability Detail
The vulnerability in the 'url-regex' package arises from the way regular expressions are processed. An attacker can craft a malicious input string that triggers a ReDoS attack, causing the regular expression matching algorithm to enter an infinite loop. This can result in significant CPU usage and impact the performance of the system. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.3. It is important to note that this vulnerability affects all versions of the 'url-regex' package up to version 1.0.4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to validate user input before passing it to the 'url-regex' package. This can be done by implementing additional input validation checks or using alternative URL parsing libraries that are not affected by this vulnerability.
Conclusion
The 'url-regex' package is vulnerable to a ReDoS attack, which can result in excessive CPU usage and potential system crashes. It is crucial to update the package to a fixed version (1.0.5 or later) to mitigate this vulnerability. If immediate updating is not possible, implementing input validation checks or using alternative URL parsing libraries can serve as temporary workarounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for url-regex →
FAQ
This vulnerability can cause excessive CPU usage and potentially crash the system. It can be exploited by an attacker to disrupt the availability of a service that relies on the 'url-regex' package.
Yes, all versions of the 'url-regex' package up to version 1.0.4 are vulnerable to this ReDoS attack.
Yes, the maintainers of the 'url-regex' package have released a fixed version (1.0.5) that addresses this vulnerability. It is recommended to update to this version or later.
ReDoS stands for Regular Expression Denial of Service. It is a type of attack where an attacker crafts a malicious input string that causes a regular expression matching algorithm to enter an infinite loop, leading to excessive CPU usage and potential system crashes.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for url-regex.
