x/vulndb: potential Go vuln in github.com/returntocorp/semgrep: CVE-2023-32758

[GoVulnBot]

CVE-2023-32758 references github.com/returntocorp/semgrep, which may be a Go module.

Description:
giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep through 1.21.0, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-32758
• JSON: https://github.com/CVEProject/cvelist/tree/986dd29331f5b814c1755353eecd1c5f49e212ef/2023/32xxx/CVE-2023-32758.json
• web: https://github.com/coala/git-url-parse/blob/master/giturlparse/parser.py#L53
• web: https://pypi.org/project/git-url-parse
• fix: fix(cli): git URL parsing for subgroups semgrep/semgrep#7611
• Imported by: https://pkg.go.dev/github.com/returntocorp/semgrep?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/returntocorp/semgrep
    packages:
      - package: n/a
description: |
    giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep through 1.21.0, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package.
cves:
  - CVE-2023-32758
references:
  - web: https://github.com/coala/git-url-parse/blob/master/giturlparse/parser.py#L53
  - web: https://pypi.org/project/git-url-parse
  - fix: https://github.com/returntocorp/semgrep/pull/7611

[gopherbot]

Change https://go.dev/cl/495335 mentions this issue: data/excluded: batch add GO-2023-1775, GO-2023-1778, GO-2023-1774, GO-2023-1771, GO-2023-1769, GO-2023-1768, GO-2023-1779

[gopherbot]

Change https://go.dev/cl/607819 mentions this issue: data/excluded: update 5 reports