CVE-2023-28755

NameCVE-2023-28755
DescriptionA ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3408-1, DLA-3447-1
Debian Bugs1036283

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
jruby (PTS)buster9.1.17.0-3vulnerable
buster (security)9.1.17.0-3+deb10u1fixed
bookworm, sid9.3.9.0+ds-8vulnerable
ruby2.5 (PTS)buster2.5.5-3+deb10u4vulnerable
buster (security)2.5.5-3+deb10u5fixed
ruby2.7 (PTS)bullseye (security), bullseye2.7.4-1+deb11u1vulnerable
ruby3.1 (PTS)bookworm, sid3.1.2-7vulnerable
rubygems (PTS)bullseye3.2.5-2vulnerable
bookworm, sid3.3.15-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jrubysourcebuster9.1.17.0-3+deb10u1DLA-3408-1
jrubysource(unstable)(unfixed)1036283
ruby2.5sourcebuster2.5.5-3+deb10u5DLA-3447-1
ruby2.5source(unstable)(unfixed)
ruby2.7source(unstable)(unfixed)
ruby3.1source(unstable)(unfixed)
rubygemssource(unstable)(unfixed)

Notes

[bookworm] - jruby <no-dsa> (Minor issue)
Fixed by: https://github.com/ruby/ruby/commit/8ce4ab146498879b65e22f1be951b25eebb79300 (v3_1_4)
Fixed by: https://github.com/ruby/uri/commit/eaf89cc31619d49e67c64d0b58ea9dc38892d175 (v0.12.1)
https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/

Search for package or bug name: Reporting problems