CVE-2022-39280 (published 2022-10-06T18:16Z)

dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. A patch has been applied in version `0.5.2`, all the users are advised to upgrade to `0.5.2` as soon as possible. Users unable to upgrade should avoid passing index server URLs in the source file to be parsed.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/pyupio/dparse
commit_details: repo_url: https://github.com/pyupio/dparse
author: Yeison Vargas
author_date: 2022-08-09 09:49:32-05:00
msg: Merge pull request #57 from pyupio/security/remove-intensive-regex

Removing index server validation
repository: repo_url: https://github.com/pyupio/dparse
repo_name: pyupio/dparse
description: A parser for Python dependency files
repo_language: Python
owner: pyupio
repo_url: https://github.com/pyupio/dparse
commit_details: repo_url: https://github.com/pyupio/dparse
author: Yeison Vargas
author_date: 2022-08-04 15:55:11-05:00
msg: Removing index server validation
repository: repo_url: https://github.com/pyupio/dparse
repo_name: pyupio/dparse
description: A parser for Python dependency files
repo_language: Python
owner: pyupio
file_changes: filename: parser.py
change_type: ModificationType.MODIFY
diff: @@ -9,7 +9,7 @@ from io import StringIO
 from configparser import ConfigParser, NoOptionError
 
 
-from .regex import URL_REGEX, HASH_REGEX
+from .regex import HASH_REGEX
 
 from .dependencies import DependencyFile, Dependency
 from packaging.requirements import Requirement as PackagingRequirement, InvalidRequirement
@@ -176,10 +176,11 @@ class Parser(object):
         :param line:
         :return:
         """
-        matches = URL_REGEX.findall(line)
-        if matches:
-            url = matches[0]
-            return url if url.endswith("/") else url + "/"
+        groups = re.split(pattern="[=\s]+", string=line.strip(), maxsplit=100)
+
+        if len(groups) >= 2:
+            return groups[1] if groups[1].endswith("/") else groups[1] + "/"
+
         return None
 
     @classmethod
@@ -346,6 +347,7 @@ class PipfileParser(Parser):
         except (toml.TomlDecodeError, IndexError) as e:
             pass
 
+
 class PipfileLockParser(Parser):
 
     def parse(self):

programming_language: Python
filename: regex.py
change_type: ModificationType.MODIFY
diff: @@ -1,39 +1,4 @@
 # -*- coding: utf-8 -*-
 from __future__ import absolute_import, print_function, unicode_literals
 
-import re
-# see https://gist.github.com/dperini/729294
-URL_REGEX = re.compile(
-    # protocol identifier
-    "(?:(?:https?|ftp)://)"
-    # user:pass authentication
-    "(?:\S+(?::\S*)?@)?"
-    "(?:"
-    # IP address exclusion
-    # private & local networks
-    "(?!(?:10|127)(?:\.\d{1,3}){3})"
-    "(?!(?:169\.254|192\.168)(?:\.\d{1,3}){2})"
-    "(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})"
-    # IP address dotted notation octets
-    # excludes loopback network 0.0.0.0
-    # excludes reserved space >= 224.0.0.0
-    # excludes network & broadcast addresses
-    # (first & last IP address of each class)
-    "(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])"
-    "(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}"
-    "(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))"
-    "|"
-    # host name
-    "(?:(?:[a-z\u00a1-\uffff0-9]-?)*[a-z\u00a1-\uffff0-9]+)"
-    # domain name
-    "(?:\.(?:[a-z\u00a1-\uffff0-9]-?)*[a-z\u00a1-\uffff0-9]+)*"
-    # TLD identifier
-    "(?:\.(?:[a-z\u00a1-\uffff]{2,}))"
-    ")"
-    # port number
-    "(?::\d{2,5})?"
-    # resource path
-    "(?:/\S*)?",
-    re.UNICODE)
-
-HASH_REGEX = r"--hash[=| ][\w]+:[\w]+"
+HASH_REGEX = r"--hash[=| ]\w+:\w+"

programming_language: Python