CVE-2023-28755

NameCVE-2023-28755
DescriptionA ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3408-1, DLA-3447-1
Debian Bugs1036283, 1038408

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
jruby (PTS)buster9.1.17.0-3vulnerable
buster (security)9.1.17.0-3+deb10u1fixed
bookworm9.3.9.0+ds-8vulnerable
sid9.4.5.0+ds-1vulnerable
ruby2.5 (PTS)buster2.5.5-3+deb10u4vulnerable
buster (security)2.5.5-3+deb10u6fixed
ruby2.7 (PTS)bullseye (security), bullseye2.7.4-1+deb11u1vulnerable
ruby3.1 (PTS)bookworm3.1.2-7vulnerable
sid, trixie3.1.2-8vulnerable
rubygems (PTS)bullseye3.2.5-2vulnerable
bookworm3.3.15-2vulnerable
sid, trixie3.4.20-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jrubysourceexperimental9.4.3.0+ds-1~exp1
jrubysourcebuster9.1.17.0-3+deb10u1DLA-3408-1
jrubysource(unstable)(unfixed)1036283
ruby2.5sourcebuster2.5.5-3+deb10u5DLA-3447-1
ruby2.5source(unstable)(unfixed)
ruby2.7source(unstable)(unfixed)
ruby3.1source(unstable)(unfixed)1038408
rubygemssource(unstable)3.4.20-1

Notes

[bookworm] - rubygems <no-dsa> (Minor issue)
[bullseye] - rubygems <no-dsa> (Minor issue)
[bookworm] - jruby <no-dsa> (Minor issue)
Fixed by: https://github.com/ruby/ruby/commit/8ce4ab146498879b65e22f1be951b25eebb79300 (v3_1_4)
Fixed by: https://github.com/ruby/uri/commit/eaf89cc31619d49e67c64d0b58ea9dc38892d175 (v0.12.1)
https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/
Incomplete fix, cf. CVE-2023-36617

Search for package or bug name: Reporting problems