Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-25167: SECURITY: Prevent ReDOS by making the SSH url regex unambiguous (#20001) · discourse/discourse@ec4c302

Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully crafted git URL. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this issue.

CVE
#vulnerability#dos#git#auth#ssh

Skip to content

    • Actions

      Automate any workflow

    • Packages

      Host and manage packages

    • Security

      Find and fix vulnerabilities

    • Codespaces

      Instant dev environments

    • Copilot

      Write better code with AI

    • Code review

      Manage code changes

    • Issues

      Plan and track work

    • Discussions

      Collaborate outside of code

*   Explore
*   All features
*   Documentation
*   GitHub Skills
*   Blog
    • For

    • Enterprise

    • Teams

    • Startups

    • Education

    • By Solution

    • CI/CD & Automation

    • DevOps

    • DevSecOps

    • Case Studies

    • Customer Stories

    • Resources

    • GitHub Sponsors

      Fund open source developers

*   The ReadME Project
    
    GitHub community articles
    

*   Repositories
*   Topics
*   Trending
*   Collections
  • Pricing

  • Notifications

  • Fork 7.9k

  • Code

  • Pull requests 62

  • Actions

  • Security

  • Insights

Permalink

Browse files

SECURITY: Prevent ReDOS by making the SSH url regex unambiguous (#20001)

Co-authored-by: Daniel Waterworth [email protected]

  • Loading branch information

1 parent 5849c81 commit ec4c30270887366dc28788bc4ab8a22a098573cd

Showing 1 changed file with 1 addition and 1 deletion.

@@ -2,7 +2,7 @@

module GitUrl

class << self

SSH_REGEXP = /(\w+@(\w+\.)*\w+):(.*)/

SSH_REGEXP = /\A(\w+@\w+(\.\w+)*):(.*)\z/

def normalize(url)

if m = SSH_REGEXP.match(url)

0 comments on commit ec4c302

Please sign in to comment.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda