CVE-2023-22799

2023-01-2610:36:21

redhat.com

access.redhat.com

flaw

rubygem

globalid

denial of service

remote attacker

regular expression denial of service

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

39.0%

JSON

A flaw was found in rubygem-globalid. RubyGem’s GlobalID gem is vulnerable to a denial of service issue caused by a regular expression denial of service (ReDoS) flaw in the model name parsing. By sending a specially-crafted regex input, a remote attacker can cause a denial of service.