Description
git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-events | 1.9.2-r1 | — |
| Wolfi rolling | argo-workflows | 3.5.2-r1 | — |
| Wolfi rolling | flux-notification-controller | 1.1.0-r6 | — |
| Wolfi rolling | melange | 0.5.3-r1 | — |
| Wolfi rolling | pulumi-kubernetes-operator | 1.14.0-r1 | — |
| Wolfi rolling | snyk-cli | 1.1297.1-r1 | — |
| Wolfi rolling | task | 3.40.1-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/whilp/git-urls | <= 1.0.1 | — | GHSA-3f2q-6294-fmq5 |