CVE-2022-42965

Опубликовано: 09 нояб. 2022

Источник: nvd

CVSS3: 3.7

CVSS3: 7.5

EPSS Низкий

Описание

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented get_file_transfer_type method

Ссылки

https://research.jfrog.com/vulnerabilities/snowflake-connector-python-redos-xray-257185/
Exploit
Third Party Advisory
https://research.jfrog.com/vulnerabilities/snowflake-connector-python-redos-xray-257185/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:snowflake:snowflake-connector-python:*:*:*:*:*:*:*:*

Версия до 2.8.2 (исключая)

EPSS

Процентиль: 41%

0.00195

Низкий

3.7 Low

CVSS3

7.5 High

CVSS3

Дефекты

CWE-1333

Связанные уязвимости

GHSA-4r6j-fwcx-94cf

CVSS3: 5.9

github

около 3 лет назад

snowflake-connector-python is vulnerable to Regular Expression Denial of Service (ReDoS)

EPSS

Процентиль: 41%

0.00195

Низкий

3.7 Low

CVSS3

7.5 High

CVSS3

Дефекты

CWE-1333