PT-2023-12181

CVE-2021-32848

Published

2023-02-20

Updated

2023-03-01

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Octobox versions prior to pull request 2807

Description Octobox is software for managing GitHub notifications. A user of the system can provide a specifically crafted search query string that will trigger a ReDoS vulnerability.

Recommendations For versions prior to pull request 2807, update to a version that includes the fix from pull request 2807 to resolve the issue. As a temporary workaround, consider restricting the ability for users to input specially crafted search query strings until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Nick Rolfe

Nickrolfe

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling

CWE-1333: Inefficient Regular Expression Complexity