ReDoS Vulnerability in gaizhenbiao/chuanhuchatgpt
Published Jun 27, 2024
7.5
HIGHCVSS 3.0
EPSS 0.66%
Description
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability is located in the filter_history function within the utils.py module. This function takes a user-provided keyword and attempts to match it against chat history filenames using a regular expression search. Due to the lack of sanitization or validation of the keyword parameter, an attacker can inject a specially crafted regular expression, leading to a denial of service condition. This can cause severe degradation of service performance and potential system unavailability.
Affected products
-
- Version unspecifiedStatusaffectedConstraints<=latest
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Gaizhenbiao | Gaizhenbiao/chuanhuchatgpt | n/a |
|
- 20240410
-
- Version 0StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Gaizhenbiao | Chuanhuchatgpt | n/a |
|
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (2)
- https://github.com/gaizhenbiao/chuanhuchatgpt/commit/fcdd5fd6b05ef537a1db185ab115758d87e1ba3f
- https://huntr.com/bounties/d41cca0a-82bc-4cbf-a52a-928d304fb42d ExploitThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/gaizhenbiao/chuanhuchatgpt/commit/fcdd5fd6b05ef537a1db185ab115758d87e1ba3f | ||
| https://huntr.com/bounties/d41cca0a-82bc-4cbf-a52a-928d304fb42d | ExploitThird Party Advisory |
Change history (0)
No recorded changes yet.