5.3 CVE-2023-28756
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
https://nvd.nist.gov/vuln/detail/CVE-2023-28756
Categories
CWE-1333 : Inefficient Regular Expression Complexity
Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
References
CONFIRM
| https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/ Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20230526-0004/ Third Party Advisory |
FEDORA
| FEDORA-2023-6b924d3b75 Mailing List Third Party Advisory |
| FEDORA-2023-a7be7ea1aa Mailing List Third Party Advisory |
| FEDORA-2023-f58d72c700 Mailing List Third Party Advisory |
MISC
| https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/ Release Notes |
| https://github.com/ruby/time/releases/ Release Notes |
| https://www.ruby-lang.org/en/downloads/releases/ Release Notes |
_MLIST
| [debian-lts-announce] 20230430 [SECURITY] [DLA 3408-1] jruby security update Mailing List Third Party Advisory |
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| cpe:2.3:a:ruby-lang:time:0.2.1:*:*:*:*:ruby:*:* | ||
| cpe:2.3:a:ruby-lang:time:0.1.0:*:*:*:*:ruby:*:* | ||
| cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* | <= 2.7.7 | |
| Configuration 2 | ||
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | ||
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | ||
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | ||
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | ||
REMEDIATION
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
Other (github, ...)
| Url |
|---|
| No known exploits |
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| 492 | Regular Expression Exponential Blowup |
MITRE
Sherlock® flash
Take a picture of your computer network in a few clicks !
The Sherlock® flash audit solution allows you to perform an audit to strengthen the security of your IT assets. Vulnerability analysis of your physical and virtual equipment. Patch planning by priority level and time available. Detailed and intuitive reporting.
