CVE-2023-28756
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific cha...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
ruby-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.8"}]}]
Bitnami
ruby
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.8"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2023-28756 ruby 修正版: 2.7.8-r0
- Debian DEBIAN-CVE-2023-28756 jruby
- Ubuntu UBUNTU-CVE-2023-28756 jruby
参照URL
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- web github.com
- web lists.debian.org
- web ruby-lang.org
- web ruby-lang.org
- web ruby-lang.org
- web lists.debian.org