Lucene search
UbuntuUSN-6219-1HistoryJul 12, 2023 - 12:00 a.m.
Ruby vulnerabilities
2023-07-1200:00:00
ubuntu.com
29
ruby
ubuntu
regular expressions
denial of service
cve-2023-28755
cve-2023-36617
incomplete fix
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
6.4 Medium
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
61.0%
Releases
- Ubuntu 23.04
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 ESM
- Ubuntu 16.04 ESM
Packages
- ruby2.3 - Object-oriented scripting language
- ruby2.5 - Object-oriented scripting language
- ruby2.7 - Object-oriented scripting language
- ruby3.0 - Interpreter of object-oriented scripting language Ruby
- ruby3.1 - Interpreter of object-oriented scripting language Ruby
Details
It was discovered that Ruby incorrectly handled certain regular expressions.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 20.10 and Ubuntu 20.04 LTS.
(CVE-2023-28755)
It was discovered that Ruby incorrectly handled certain regular expressions.
An attacker could possibly use this issue to cause a denial of service.
This issue exists because of an incomplete fix for CVE-2023-28755.
(CVE-2023-36617)
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 23.04 | noarch | ruby3.1 | < 3.1.2-6ubuntu0.23.04.2 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libruby3.1 | < 3.1.2-6ubuntu0.23.04.2 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libruby3.1-dbgsym | < 3.1.2-6ubuntu0.23.04.2 | UNKNOWN |
| Ubuntu | 23.04 | noarch | ruby3.1-dbgsym | < 3.1.2-6ubuntu0.23.04.2 | UNKNOWN |
| Ubuntu | 23.04 | noarch | ruby3.1-dev | < 3.1.2-6ubuntu0.23.04.2 | UNKNOWN |
| Ubuntu | 23.04 | noarch | ruby3.1-doc | < 3.1.2-6ubuntu0.23.04.2 | UNKNOWN |
| Ubuntu | 22.10 | noarch | ruby3.0 | < 3.0.4-7ubuntu0.2 | UNKNOWN |
| Ubuntu | 22.10 | noarch | libruby3.0 | < 3.0.4-7ubuntu0.2 | UNKNOWN |
| Ubuntu | 22.10 | noarch | libruby3.0-dbgsym | < 3.0.4-7ubuntu0.2 | UNKNOWN |
| Ubuntu | 22.10 | noarch | ruby3.0-dbgsym | < 3.0.4-7ubuntu0.2 | UNKNOWN |
Related
ubuntucve
ubuntucve
CVE-2023-36617
2023-06-29 00:00:00
CVE-2023-28755
2023-03-31 00:00:00
cloudfoundry
cloudfoundry
USN-6219-1: Ruby vulnerabilities | Cloud Foundry
2023-09-28 00:00:00
USN-6055-2: Ruby regression | Cloud Foundry
2023-06-30 00:00:00
USN-6055-1: Ruby vulnerabilities | Cloud Foundry
2023-06-30 00:00:00
redhatcve
redhatcve
CVE-2023-36617
2023-07-13 11:36:22
CVE-2023-28755
2023-04-03 14:43:40
nvd
nvd
CVE-2023-36617
2023-06-29 13:15:09
CVE-2023-28755
2023-03-31 04:15:09
openvas
openvas
Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2023-2800)
2023-09-11 00:00:00
Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2023-2851)
2023-09-20 00:00:00
Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2023-2868)
2023-09-20 00:00:00
osv
osv
ruby2.3, ruby2.5, ruby2.7, ruby3.0, ruby3.1 vulnerabilities
2023-07-12 14:47:58
CVE-2023-36617
2023-06-29 13:15:09
URI gem has ReDoS vulnerability
2023-06-29 15:30:34
cvelist
cvelist
CVE-2023-36617
2023-06-29 00:00:00
CVE-2023-28755
2023-03-31 00:00:00
veracode
veracode
Regular Expression Denial Of Service (ReDoS)
2023-06-30 03:59:11
Regular Expression Denial Of Service (ReDoS)
2023-04-04 14:02:44
nessus
nessus
EulerOS 2.0 SP11 : ruby (EulerOS-SA-2023-2868)
2024-01-16 00:00:00
Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : Ruby vulnerabilities (USN-6219-1)
2023-07-12 00:00:00
EulerOS 2.0 SP10 : ruby (EulerOS-SA-2023-2824)
2024-01-16 00:00:00
cve
cve
CVE-2023-36617
2023-06-29 13:15:09
CVE-2023-28755
2023-03-31 04:15:09
hackerone
hackerone
Internet Bug Bounty: CVE-2023-36617: ReDoS vulnerability in URI (Ruby)
2023-07-17 05:09:41
Ruby: URI parser's RFC3986 regular expression has poor performance when there are two # characters, leading to ReDoS
2022-01-09 14:12:19
Internet Bug Bounty: CVE-2023-28755: ReDoS vulnerability in URI
2023-04-13 02:03:53
debiancve
debiancve
CVE-2023-36617
2023-06-29 13:15:09
CVE-2023-28755
2023-03-31 04:15:09
prion
prion
Design/Logic Flaw
2023-06-29 13:15:00
Authentication flaw
2023-03-31 04:15:00
github
github
URI gem has ReDoS vulnerability
2023-06-29 15:30:34
Ruby URI component ReDoS issue
2023-03-31 06:30:15
rubygems
rubygems
ReDoS vulnerability in URI
2023-06-28 21:00:00
almalinux
almalinux
Moderate: ruby:3.1 security, bug fix, and enhancement update
2024-03-19 00:00:00
Moderate: ruby:3.1 security, bug fix, and enhancement update
2024-04-01 00:00:00
Moderate: ruby:2.7 security, bug fix, and enhancement update
2023-06-27 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2024-5.0-0247
2024-04-16 00:00:00
Critical Photon OS Security Update - PHSA-2024-4.0-0592
2024-04-17 00:00:00
oraclelinux
oraclelinux
ruby:3.1 security, bug fix, and enhancement update
2024-03-20 00:00:00
ruby:3.1 security, bug fix, and enhancement update
2024-04-02 00:00:00
ruby:2.7 security, bug fix, and enhancement update
2023-07-08 00:00:00
rocky
rocky
ruby:3.1 security, bug fix, and enhancement update
2024-03-27 04:34:32
ruby:3.1 security, bug fix, and enhancement update
2024-04-05 14:57:12
ruby:2.7 security, bug fix, and enhancement update
2023-08-31 16:54:34
redhat
redhat
cbl_mariner
cbl_mariner
CVE-2023-36617 affecting package ruby for versions less than 3.1.4-2
2023-08-30 14:44:06
cgr
cgr
CVE-2023-36617 vulnerabilities
2024-05-19 03:07:16
CVE-2023-28755 vulnerabilities
2024-05-19 03:07:16
fedora
fedora
[SECURITY] Fedora 38 Update: ruby-3.2.4-182.fc38
2024-05-04 02:20:05
[SECURITY] Fedora 39 Update: ruby-3.2.4-182.fc39
2024-05-04 01:33:23
[SECURITY] Fedora 36 Update: ruby-3.1.4-175.fc36
2023-04-21 01:25:27
wolfi
wolfi
CVE-2023-36617 vulnerabilities
2024-07-03 09:08:38
CVE-2023-28755 vulnerabilities
2024-07-03 09:08:38
alpinelinux
alpinelinux
CVE-2023-28755
2023-03-31 04:15:09
ubuntu
ubuntu
Ruby regression
2023-05-05 00:00:00
Ruby vulnerabilities
2023-05-18 00:00:00
Ruby vulnerabilities
2023-05-04 00:00:00
freebsd
freebsd
rubygem-uri -- ReDoS vulnerability
2023-03-28 00:00:00
redos
redos
ROS-20230929-01
2023-09-29 00:00:00
slackware
slackware
[slackware-security] ruby
2023-03-31 18:29:16
debian
debian
[SECURITY] [DLA 3447-1] ruby2.5 security update
2023-06-07 20:38:22
[SECURITY] [DLA 3408-1] jruby security update
2023-04-30 20:58:08
thn
thn
gentoo
gentoo
Ruby: Multiple vulnerabilities
2024-01-24 00:00:00
ibm
ibm
ics
ics
Siemens SCALANCE XCM-/XRM-300
2024-02-15 12:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
6.4 Medium
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
61.0%
Related for USN-6219-1