CVE-2022-24713: Regular expression denial of service in Rust's regex crate
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, it us not recommend to deny known problematic regexes.
Other sources
Regular expression denial of service in Rust's regex crate
— Microsoft
The rust regex crate did not properly prevent crafted regular expressions from taking an arbitrary amount of time during parsing. If an attacker was able to supply input to this crate, they could have caused a denial of service in the browser.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 118.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.12.0esr-1~deb10u1Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1 - Upgrade
Upgrade
debian/rust-regexto a version that resolves this vulnerability.Fixed in 1.7.1-1Fixed in 1.7.3-1Fixed in 1.9.6-5 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:91.12.0-1~deb10u1Fixed in 1:115.3.1-1~deb10u1Fixed in 1:102.13.1-1~deb11u1Fixed in 1:115.3.1-1~deb11u1Fixed in 1:102.15.1-1~deb12u1Fixed in 1:115.3.1-1~deb12u1Fixed in 1:115.3.1-1 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 91.8 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 91.8 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 99 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2024.4-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.58.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in regex-1.8.4 - Upgrade
Upgrade
regex crateto a version that resolves this vulnerability.Fixed in 1.5.5 - Compensating control
Do not rely on denying a fixed set of 'known problematic regexes'—the material states there is no fixed set of problematic regexes because it is practically infinite.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID?
CVE-2022-24713
What is the severity of CVE-2022-24713?
The severity of CVE-2022-24713 is high with a severity value of 7.5.
Which software products are affected by CVE-2022-24713?
Mozilla Firefox ESR, Mozilla Firefox, Debian Firefox, Debian Firefox ESR, Rust-regex, and Thunderbird are affected by CVE-2022-24713.
How can I fix CVE-2022-24713?
To fix CVE-2022-24713, update to the recommended versions: Mozilla Firefox ESR 91.8, Mozilla Firefox 99, Debian Firefox 118.0.2-1, Debian Firefox ESR 91.12.0esr-1~deb10u1 or 91.12.0-1~deb10u1, Rust-regex 1.7.1-1, and Thunderbird 91.8.
Are there any references or additional information about CVE-2022-24713?
Yes, you can find more information about CVE-2022-24713 in the references: [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1758509), [Mozilla Security Advisory](https://www.mozilla.org/en-US/security/advisories/mfsa2022-14/), and [GitHub commit](https://github.com/rust-lang/regex/commit/ae70b41d4f46641dbc45c7a4f87954aea356283e).