CVE-2022-31110
This results in an impact on the performance of the servers and RSSHub services which may lead to a denial of service.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. This results in an impact on the performance of the servers and RSSHub services which may lead to a denial of service. This issue has been fixed in commit 5c4177441417 and all users are advised to upgrade. There are no known workarounds for this issue.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.55% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400, CWE-1333
- Affected
- rsshub/rsshub
- Source
- security-advisories@github.com
References
- https://github.com/DIYgod/RSSHub/commit/5c4177441417b44a6e45c3c63e9eac2504abeb5bPatch, Third Party Advisory
- https://github.com/DIYgod/RSSHub/issues/10045Exploit, Issue Tracking, Mitigation, Third Party Advisory
- https://github.com/DIYgod/RSSHub/security/advisories/GHSA-jvxx-v45p-v5vfPatch, Third Party Advisory
- https://github.com/DIYgod/RSSHub/commit/5c4177441417b44a6e45c3c63e9eac2504abeb5bPatch, Third Party Advisory
- https://github.com/DIYgod/RSSHub/issues/10045Exploit, Issue Tracking, Mitigation, Third Party Advisory
- https://github.com/DIYgod/RSSHub/security/advisories/GHSA-jvxx-v45p-v5vfPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.