CVE-2021-39229

Katalog CVE

CVSS 7.5 · High EPSS 1,9%

Kerentanan Uncontrolled Resource Consumption pada nuxref apprise. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them access to the IFTTT plugin (which just comes out of the box) are subject to a denial of service attack on an inefficient regular expression. The vulnerable regular expression is [here](https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359). The problem has been patched in release version 0.9.5.1. Users who are unable to upgrade are advised to remove `apprise/plugins/NotifyIFTTT.py` to eliminate the service.

Rincian

Terbit di NVD

20 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/caronc/apprise/pull/436 patch · advisory pihak ketiga
• https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py... exploit · advisory pihak ketiga
• https://github.com/caronc/apprise/security/advisories/GHSA-qhmp-h54x-38qr advisory pihak ketiga