CVE-2023-28756
At a glance
- Source
- NVD
- EPSS
- EPSS 2.45 % · percentile 84 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
Weaknesses (CWE)
- CWE-1333 — Inefficient Regular Expression Complexity
References
- https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/
- https://www.ruby-lang.org/en/downloads/releases/
- https://github.com/ruby/time/releases/
- https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
- https://security.netapp.com/advisory/ntap-20230526-0004/
- https://security.gentoo.org/glsa/202401-27
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-fg7x-g82r-94qc — Ruby Time component ReDoS issue
European references
- ENISA EUVD · EUVD-2023-0999
- GCVE · GCVE-0-2023-28756
CERT-FR advisories
- CERTFR-2025-AVI-0622 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0596 — Multiples vulnérabilités dans Oracle PeopleSoft · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*≤ 2.7.7cpe:2.3:a:ruby-lang:time:0.1.0:*:*:*:*:ruby:*:*cpe:2.3:a:ruby-lang:time:0.2.1:*:*:*:*:ruby:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |