Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide a specifically crafted search query string that will trigger a ReDoS vulnerability. This issue is fixed in PR 2807.
References
| Link | Resource |
|---|---|
| https://github.com/octobox/octobox/blob/372a0da981dbf47319fed4116364118fdf09fcc3/lib/search_parser.rb#L5 | Exploit Product |
| https://github.com/octobox/octobox/pull/2807 | Patch |
| https://securitylab.github.com/advisories/GHSL-2021-100-octobox-octobox/ | Exploit Third Party Advisory |
Configurations
History
01 Mar 2023, 18:44
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-1333 | |
| CPE | cpe:2.3:a:octobox_project:octobox:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | (MISC) https://github.com/octobox/octobox/blob/372a0da981dbf47319fed4116364118fdf09fcc3/lib/search_parser.rb#L5 - Exploit, Product | |
| References | (MISC) https://github.com/octobox/octobox/pull/2807 - Patch | |
| References | (CONFIRM) https://securitylab.github.com/advisories/GHSL-2021-100-octobox-octobox/ - Exploit, Third Party Advisory |
21 Feb 2023, 14:50
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-02-20 17:15
Updated : 2024-02-04 23:14
NVD link : CVE-2021-32848
Mitre link : CVE-2021-32848
CVE.ORG link : CVE-2021-32848
JSON object : View
Products Affected
octobox_project
- octobox