NVD Vulnerability Detail

CVE-2021-39229

Summary	Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them access to the IFTTT plugin (which just comes out of the box) are subject to a denial of service attack on an inefficient regular expression. The vulnerable regular expression is [here](https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359). The problem has been patched in release version 0.9.5.1. Users who are unable to upgrade are advised to remove `apprise/plugins/NotifyIFTTT.py` to eliminate the service.
Publication Date	Sept. 21, 2021, 7:15 a.m.
Registration Date	Sept. 21, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:18 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:nuxref:apprise::::::::					0.9.5.1

Related information, measures and tools

No	URL	タグ
1	https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359	Exploit Third Party Advisory
2	https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359	Exploit Third Party Advisory
3	https://github.com/caronc/apprise/pull/436	Patch Third Party Advisory
4	https://github.com/caronc/apprise/pull/436	Patch Third Party Advisory
5	https://github.com/caronc/apprise/security/advisories/GHSA-qhmp-h54x-38qr	Third Party Advisory
6	https://github.com/caronc/apprise/security/advisories/GHSA-qhmp-h54x-38qr	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-400	リソースの枯渇	https://cwe.mitre.org/data/definitions/400.html

JVN Vulnerability Information

Apprise におけるリソースの枯渇に関する脆弱性

Title	Apprise におけるリソースの枯渇に関する脆弱性
Summary	Apprise には、リソースの枯渇に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 7, 2021, midnight
Registration Date	Sept. 5, 2022, 11:04 a.m.
Last Update	Sept. 5, 2022, 11:04 a.m.

Affected System

nuxref

Apprise 0.9.5.1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-39229	https://www.cve.org/CVERecord?id=CVE-2021-39229
National Vulnerability Database (NVD)
2	CVE-2021-39229	https://nvd.nist.gov/vuln/detail/CVE-2021-39229

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-400	https://cwe.mitre.org/data/definitions/400.html

ベンダー情報

No	Name	URL
GitHub
1	apprise/apprise/plugins/NotifyIFTTT.py	https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359
2	CWE-730 Regex injection with IFTTT Plugin	https://github.com/caronc/apprise/security/advisories/GHSA-qhmp-h54x-38qr
3	Slight bulletproofing to IFTTT regex handling #436	https://github.com/caronc/apprise/pull/436

Change Log

No	Changed Details	Date of change
1	[2022年09月05日] 掲載	Sept. 5, 2022, 11:04 a.m.