Unpatched path-to-regexp ReDoS in 0.1.x

[goshop4eva]

Hi @blakeembrey , can this be fixed it looks like a high vulerability issue thanks

GHSA-rhx6-c78j-4q9w

[blakeembrey]

@goshop4eva you have linked to the report I filed myself that shows it’s patched in 0.1.12, do you have a new vulnerability you’re trying to report?

[goshop4eva]

@blakeembrey I see the advisories is high and just wanted to understand the reason for this being a moderate severity thanks

GHSA-rhx6-c78j-4q9w

[blakeembrey]

I filed it to the best of my ability and don’t have the capacity to figure out if something is incorrect right now, but I trust that when GitHub reviewed it and officially published it they did the right thing.

[goshop4eva]

@blakeembrey totally understand the capacity issue but I think this vulnerability has been rose to high severity according to the national vulnerability database. I am hoping that your information stays consistent with it and hopefully raise the priority for this fix to be reviewed again. Thanks for your help

I have linked the nist government website below for your reference

https://nvd.nist.gov/vuln/detail/CVE-2024-52798

[blakeembrey]

@goshop4eva I don't think it's possible to stay perfectly consistent, I can't appear to use the same severity vector string so it'll be a different score.

Can you share why this is important? If it is important I'd like to do this for all reports but it's never come up before and would like to make sure I'm focused on the things that matter the most.

Right now, if I use the same vector string, I have to remove /E:P which gives me a higher severity score of 8.7 instead of 7.7.