CVE-2022-39280

Regex DoS in dparse < 0.5.2

• CVSS 7.5
• CWE-1333
• Input Validation and Sanitization
• Remote

dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. A patch has been applied in version `0.5.2`, all the users are advised to upgrade to `0.5.2` as soon as possible. Users unable to upgrade should avoid passing index server URLs in the source file to be parsed.

CVE

CVE-2022-39280

CWE

CWE-1333

CVSS base score

7.5

Published

2022-10-06

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update dparse to version 0.5.2 or higher.

import re

def parse_index_url(url):
    """Vulnerable function that demonstrates the security issue."""
    pattern = r'^(https?://.*)$'
    match = re.match(pattern, url)
    if match:
        return match.group(0)
    else:
        raise ValueError("Invalid index server URL")

try:
    url = "https://example.com/index"
    print(parse_index_url(url))
except ValueError as e:
    print(e)

import re

def parse_index_url(url):
    """Secure function that fixes the vulnerability."""
    pattern = r'^(https?://[^\s/$.?#].[^\s]*)$'
    match = re.match(pattern, url)
    if match:
        return match.group(0)
    else:
        raise ValueError("Invalid index server URL")

try:
    url = "https://example.com/index"
    print(parse_index_url(url))
except ValueError as e:
    print(e)

@misc{vaitp:cve202239280,
  title        = {{Regex DoS in dparse < 0.5.2}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-39280},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-39280/}}
}