Lucene search
PRIOn knowledge basePRION:CVE-2022-23517HistoryDec 14, 2022 - 5:15 p.m.
Design/Logic Flaw
2022-12-1417:15:00
PRIOn knowledge base
www.prio-n.com
5
rails-html-sanitizer
vulnerability
patched
version 1.4.4
denial of service
cpu resource consumption
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.
| CPE | Name | Operator | Version |
|---|---|---|---|
| debian_linux | eq | 10.0 | |
| rails_html_sanitizers | lt | 1.4.4 |
Related
osv
osv
Inefficient Regular Expression Complexity in rails-html-sanitizer
2022-12-13 17:43:02
CVE-2022-23517
2022-12-14 17:15:10
ruby-rails-html-sanitizer - security update
2023-09-13 00:00:00
github
github
Inefficient Regular Expression Complexity in rails-html-sanitizer
2022-12-13 17:43:02
nvd
nvd
CVE-2022-23517
2022-12-14 17:15:10
cve
cve
CVE-2022-23517
2022-12-14 17:15:10
cvelist
cvelist
ubuntucve
ubuntucve
CVE-2022-23517
2022-12-14 00:00:00
veracode
veracode
Regular Expression Denial Of Service (ReDoS)
2022-12-15 02:04:21
redhatcve
redhatcve
CVE-2022-23517
2022-12-15 10:04:46
debiancve
debiancve
CVE-2022-23517
2022-12-14 17:15:10
hackerone
hackerone
Ruby on Rails: ReDoS (Rails::Html::PermitScrubber.scrub_attribute)
2022-08-30 02:48:16
openvas
openvas
openSUSE: Security Advisory for rubygem (SUSE-SU-2023:3714-1)
2024-03-04 00:00:00
Debian: Security Advisory (DLA-3566-1)
2023-09-14 00:00:00
nessus
nessus
Debian DLA-3566-1 : ruby-rails-html-sanitizer - LTS security update
2023-09-14 00:00:00
SUSE SLES15 / openSUSE 15 Security Update : rubygem-rails-html-sanitizer (SUSE-SU-2023:3714-1)
2023-09-21 00:00:00
Rocky Linux 8 : Satellite 6.13 Release (Important) (RLSA-2023:2097)
2023-05-05 00:00:00
debian
debian
[SECURITY] [DLA 3566-1] ruby-rails-html-sanitizer security update
2023-09-13 15:09:12
rocky
rocky
Satellite 6.13 Release
2023-05-05 15:39:58
redhat
redhat
(RHSA-2023:2097) Important: Satellite 6.13 Release
2023-05-03 13:09:51