CVE-2024-43380

fugit contains time tools for flor and the floraison group. The fugit "natural" parser, that turns "every wednesday at 5pm" into "0 17 * * 3", accepted any length of input and went on attempting to parse it, not returning promptly, as expected. The parse call could hold the thread with no end in sight. Fugit dependents that do not check (user) input length for plausibility are impacted. A fix was released in fugit 1.11.1.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/floraison/fugit/commit/ad2c1c9c737213d585fff0b51c927d178b2c05a5	Patch
https://github.com/floraison/fugit/issues/104	Issue Tracking Patch
https://github.com/floraison/fugit/security/advisories/GHSA-2m96-52r3-2f3g	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:floraison:fugit:*:*:*:*:*:ruby:*:*

History

No history.

Information

Published : 2024-08-19 15:15

Updated : 2024-08-21 12:38

NVD link : CVE-2024-43380

Mitre link : CVE-2024-43380

CVE.ORG link : CVE-2024-43380

JSON object : View

Products Affected

floraison

fugit

CWE

CWE-400

Uncontrolled Resource Consumption

NVD-CWE-noinfo

{"id": "CVE-2024-43380", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-08-19T15:15:08.893", "references": [{"url": "https://github.com/floraison/fugit/commit/ad2c1c9c737213d585fff0b51c927d178b2c05a5", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/floraison/fugit/issues/104", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/floraison/fugit/security/advisories/GHSA-2m96-52r3-2f3g", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "fugit contains time tools for flor and the floraison group. The fugit \"natural\" parser, that turns \"every wednesday at 5pm\" into \"0 17 * * 3\", accepted any length of input and went on attempting to parse it, not returning promptly, as expected. The parse call could hold the thread with no end in sight. Fugit dependents that do not check (user) input length for plausibility are impacted. A fix was released in fugit 1.11.1."}, {"lang": "es", "value": "fugit contiene herramientas de tiempo para flor y el grupo floraison. El analizador \"natural\" fugit, que convierte \"todos los mi\u00e9rcoles a las 5 p.m.\" en \"0 17 * * 3\", acept\u00f3 cualquier longitud de entrada y continu\u00f3 intentando analizarla, sin regresar r\u00e1pidamente, como se esperaba. La llamada de an\u00e1lisis podr\u00eda mantener el hilo sin un final a la vista. Los dependientes de Fugit que no verifican la plausibilidad de la longitud de entrada (del usuario) se ven afectados. Se public\u00f3 una soluci\u00f3n en fugit 1.11.1."}], "lastModified": "2024-08-21T12:38:00.247", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:floraison:fugit:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "7FA5151C-7CD2-4FC9-B141-F5BF715E5592", "versionEndExcluding": "1.11.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}