GHSA-fg7x-g82r-94qc
Ruby Time component ReDoS issue
At a glance
- Published
- Updated
- CVE
- CVE-2023-28756
- Aliases
- BIT-ruby-2023-28756, BIT-ruby-min-2023-28756
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
Affected packages
| Package | Versions |
|---|---|
| RubyGems · time | introduced 0.2.0, fixed 0.2.2 |
| RubyGems · time | introduced 0, fixed 0.1.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-28756 ADVISORY
- https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756 WEB
- https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released WEB
- https://www.ruby-lang.org/en/downloads/releases WEB
- https://security.netapp.com/advisory/ntap-20230526-0004 WEB
- https://security.gentoo.org/glsa/202401-27 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA WEB
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html WEB
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/time/CVE-2023-28756.yml WEB
- https://github.com/ruby/time/releases WEB
- https://github.com/ruby/time PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |