CVE-2008-3443

Name	CVE-2008-3443
Description	The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DSA-1695-1
NVD severity	medium
Debian Bugs	494401

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ruby1.8	source	(unstable)	1.8.7.72-1	low		494401
ruby1.8	source	etch	1.8.5-4etch4		DSA-1695-1
ruby1.9	source	(unstable)	1.9.0.2-9	low
ruby1.9	source	etch	1.9.0+20060609-1etch4		DSA-1695-1

Notes

Upstream commits 18212 (for 1.8) and 18213 (for 1.9).
this specific problem does not exist in ruby1.9 but a very similar problem
that has been fixed in this version (308_regexp_segv.dpatch)