CVE-2021-39229CWE-400

Regular expression deinal of service in apprise

High · published September 20, 2021

CVSS v3.1
7.5
EPSS
2%
Percentile
79.4
In the wild
Unconfirmed
What it is

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them access to the IFTTT plugin (which just comes out of the box) are subject to a denial of service attack on an inefficient regular expression. The vulnerable regular expression is [here](https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359). The problem has been patched in release version 0.9.5.1. Users who are unable to upgrade are advised to remove `apprise/plugins/NotifyIFTTT.py` to eliminate the service.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01891 · 79.4th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2021-09-20T21:20Z
EPSS history
Timeline
  • 20 SEP 21:20Z
    Regular expression deinal of service in apprise
    cvelistv5