CVE-2024-43380CWE-400

fugit parse and parse_nat stall on lengthy input

Medium · published August 19, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
56.1
In the wild
Unconfirmed
What it is

fugit contains time tools for flor and the floraison group. The fugit "natural" parser, that turns "every wednesday at 5pm" into "0 17 * * 3", accepted any length of input and went on attempting to parse it, not returning promptly, as expected. The parse call could hold the thread with no end in sight. Fugit dependents that do not check (user) input length for plausibility are impacted. A fix was released in fugit 1.11.1.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00798 · 56.1th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-08-19T14:37Z
EPSS history
Timeline
  • 19 AUG 14:37Z
    fugit parse and parse_nat stall on lengthy input
    cvelistv5