[Forgot Password]
Login  Register Subscribe

30479

 
 

423868

 
 

250039

 
 

909

 
 

195882

 
 

282

Paid content will be excluded from the download.


Download | Alert*
OVAL

ALAS2RUBY3.0-2023-001 --- ruby

ID: oval:org.secpod.oval:def:1701703Date: (C)2023-10-26   (M)2024-01-29
Class: PATCHFamily: unix




A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2

Platform:
Amazon Linux 2
Product:
ruby
rubygem-bigdecimal
rubygem-bundler
rubygem-rexml
rubygem-io-console
rubygem-irb
rubygem-json
rubygem-minitest
rubygem-rss
rubygem-rbs
rubygem-power_assert
rubygem-psych
rubygem-rdoc
rubygem-test-unit
rubygem-typeprof
rubygems
rubygem-rake
Reference:
ALAS2RUBY3.0-2023-001
CVE-2023-28755
CVE-2023-28756
CVE    2
CVE-2023-28756
CVE-2023-28755
CPE    6
cpe:/a:rubygem:rubygem-json
cpe:/a:rubygems:rubygem-rake
cpe:/a:gembundler:rubygem-bundler
cpe:/a:ruby:ruby
...

© SecPod Technologies