CVE-2023-28756
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific cha...
Original description
The description as published by the source.
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
ruby-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.8"}]}]
Bitnami
ruby
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.8"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2023-28756 ruby Fixed in: 2.7.8-r0
- Debian DEBIAN-CVE-2023-28756 jruby
- Ubuntu UBUNTU-CVE-2023-28756 jruby
References
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- web github.com
- web lists.debian.org
- web ruby-lang.org
- web ruby-lang.org
- web ruby-lang.org
- web lists.debian.org