CVE-2021-29932: Uncontrolled Resource Consumption in parse_duration

August 25, 2021

An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption) via a duration string with a large exponent.

References

github.com/advisories/GHSA-qpgv-g792-wh6x
github.com/zeta12ti/parse_duration
github.com/zeta12ti/parse_duration/issues/21
nvd.nist.gov/vuln/detail/CVE-2021-29932
rustsec.org/advisories/RUSTSEC-2021-0041.html

Detect and mitigate CVE-2021-29932 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →