CVE-2023-28756

NameCVE-2023-28756
DescriptionA ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3408-1, DLA-3447-1
Debian Bugs1036283, 1038408

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
jruby (PTS)buster9.1.17.0-3vulnerable
buster (security)9.1.17.0-3+deb10u1fixed
bookworm9.3.9.0+ds-8vulnerable
trixie9.4.6.0+ds-1vulnerable
sid9.4.6.0+ds-1.1vulnerable
ruby2.5 (PTS)buster2.5.5-3+deb10u4vulnerable
buster (security)2.5.5-3+deb10u6fixed
ruby2.7 (PTS)bullseye (security), bullseye2.7.4-1+deb11u1vulnerable
ruby3.1 (PTS)bookworm3.1.2-7vulnerable
trixie3.1.2-8vulnerable
sid3.1.2-8.3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jrubysourceexperimental9.4.3.0+ds-1~exp1
jrubysourcebuster9.1.17.0-3+deb10u1DLA-3408-1
jrubysource(unstable)(unfixed)1036283
ruby2.5sourcebuster2.5.5-3+deb10u5DLA-3447-1
ruby2.5source(unstable)(unfixed)
ruby2.7source(unstable)(unfixed)
ruby3.1source(unstable)(unfixed)1038408

Notes

[bookworm] - jruby <no-dsa> (Minor issue)
Fixed by: https://github.com/ruby/ruby/commit/957bb7cb81995f26c671afce0ee50a5c660e540e (v3_1_4)
Fixed by: https://github.com/ruby/time/commit/b57db51f577875d3e896dcd2ef1dcaf97f23e943 (v0.2.2)
Fixed by: https://github.com/ruby/time/commit/3dce6f73d14f5fad6d9b302393fd02df48797b11 (v0.2.2)
https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/

Search for package or bug name: Reporting problems