Veracode Vulnerability DatabaseVERACODE:40040Regular Expression Denial Of Service (ReDoS)
0.003 Low
EPSS
Percentile
69.5%
time is vulnerable to Regular Expression Denial Of Service (ReDoS). The vulnerability exists due to the insecure Regex pattern used in the rfc2822 function of time.rb, which allows an attacker to crash the application by providing an invalid time.
References
github.com/advisories/GHSA-fg7x-g82r-94qc
github.com/ruby/time/commit/3765d119ca03db067f9cd292752389983e2821eb
github.com/ruby/time/commit/b57db51f577875d3e896dcd2ef1dcaf97f23e943
github.com/ruby/time/releases/
hackerone.com/reports/1485501
lists.debian.org/debian-lts-announce/2023/04/msg00033.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/
lists.fedoraproject.org/archives/list/[email protected]/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/
lists.fedoraproject.org/archives/list/[email protected]/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/
lists.fedoraproject.org/archives/list/[email protected]/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/
secdb.alpinelinux.org/edge/main.yaml
secdb.alpinelinux.org/v3.14/main.yaml
secdb.alpinelinux.org/v3.15/main.yaml
secdb.alpinelinux.org/v3.16/main.yaml
secdb.alpinelinux.org/v3.17/main.yaml
security.gentoo.org/glsa/202401-27
security.netapp.com/advisory/ntap-20230526-0004/
www.ruby-lang.org/en/downloads/releases/
www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/
www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/
Related
