CVE-2023-28756

2023-03-3104:15:09

Debian Security Bug Tracker

security-tracker.debian.org

cve-2023-28756

time component

ruby

redos

vulnerability

execution time

parsing

urls

fixed versions

unix

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

0.003 Low

EPSS

Percentile

69.5%

JSON

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

OSVersionArchitecturePackageVersionFilename
Debian12alljruby<= 9.3.9.0+ds-8jruby_9.3.9.0+ds-8_all.deb
Debian999alljruby<= 9.4.6.0+ds-1.1jruby_9.4.6.0+ds-1.1_all.deb
Debian13alljruby<= 9.4.6.0+ds-1.1jruby_9.4.6.0+ds-1.1_all.deb
Debian11allruby2.7<= 2.7.4-1+deb11u1ruby2.7_2.7.4-1+deb11u1_all.deb
Debian12allruby3.1<= 3.1.2-7+deb12u1ruby3.1_3.1.2-7+deb12u1_all.deb
Debian999allruby3.1<= 3.1.2-8.3ruby3.1_3.1.2-8.3_all.deb
Debian13allruby3.1<= 3.1.2-8.3ruby3.1_3.1.2-8.3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	jruby	<= 9.3.9.0+ds-8	jruby_9.3.9.0+ds-8_all.deb
Debian	999	all	jruby	<= 9.4.6.0+ds-1.1	jruby_9.4.6.0+ds-1.1_all.deb
Debian	13	all	jruby	<= 9.4.6.0+ds-1.1	jruby_9.4.6.0+ds-1.1_all.deb
Debian	11	all	ruby2.7	<= 2.7.4-1+deb11u1	ruby2.7_2.7.4-1+deb11u1_all.deb
Debian	12	all	ruby3.1	<= 3.1.2-7+deb12u1	ruby3.1_3.1.2-7+deb12u1_all.deb
Debian	999	all	ruby3.1	<= 3.1.2-8.3	ruby3.1_3.1.2-8.3_all.deb
Debian	13	all	ruby3.1	<= 3.1.2-8.3	ruby3.1_3.1.2-8.3_all.deb