Stack overflow during recursive expression parsing (CVE-2022-31099)

Résumé

Stack overflow during recursive expression parsing

Description d'origine

La description telle que publiée par la source (souvent en anglais).

When parsing untrusted rulex expressions, the stack may overflow, possibly
enabling a Denial of Service attack. This happens when parsing an expression
with several hundred levels of nesting, causing the process to abort
immediately.

The flaw was corrected in commits 60aa2dc03a by adding a check to recursion
depth.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

crates.io rulex

[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.4.3"}]}]

Références

advisory rustsec.org
package crates.io
web github.com