CVE-2023-28755
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific char...
Résumé
Ruby URI component ReDoS issue
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
RubyGems
uri
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0.1"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2023-28755 ruby Corrigé dans: 2.7.8-r0
- Debian DEBIAN-CVE-2023-28755 jruby
- Ubuntu UBUNTU-CVE-2023-28755 ruby2.3 Corrigé dans: 2.3.1-2~ubuntu16.04.16+esm7
Références
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory security.netapp.com
- package github.com
- web ruby-lang.org
- web ruby-lang.org
- web ruby-lang.org
- web security.netapp.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web github.com
- web github.com
- web github.com
- web lists.fedoraproject.org
- web ruby-lang.org
- web ruby-lang.org
- web ruby-lang.org