Coordinated Disclosure Timeline
- 2021-08-31: Created an issue asking for contact details.
- 2021-11-30: Deadline expired.
- 2021-12-06: Created a pull request to fix the bug.
StreamAlert contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service).
ReDoS, or Regular Expression Denial of Service, is a vulnerability affecting inefficient regular expressions which can perform extremely badly when run on a crafted input string.
The vulnerable regular expression is here.
To see that the regular expression is vulnerable, copy-paste it into a separate file as shown below:
- Run the code below with
import re _URL_REGEX = re.compile( r'^(?:http(s)?://)?[\w.-]+(?:\.[\w\.-]+)+[\w\-\._~:/?#[\]@!\$&\'\(\)\*\+,;=.]+$' ) _URL_REGEX.match("https://a.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-}");
This issue may lead to a denial of service.
You can contact the GHSL team at
email@example.com, please include a reference to
GHSL-2021-121 in any communication regarding this issue.