CVE-2023-28756

NameCVE-2023-28756
DescriptionA ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3408-1
Debian Bugs1036283

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
jruby (PTS)buster9.1.17.0-3vulnerable
buster (security)9.1.17.0-3+deb10u1fixed
bookworm, sid9.3.9.0+ds-8vulnerable
ruby2.5 (PTS)buster, buster (security)2.5.5-3+deb10u4vulnerable
ruby2.7 (PTS)bullseye (security), bullseye2.7.4-1+deb11u1vulnerable
ruby3.1 (PTS)bookworm, sid3.1.2-7vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jrubysourcebuster9.1.17.0-3+deb10u1DLA-3408-1
jrubysource(unstable)(unfixed)1036283
ruby2.5source(unstable)(unfixed)
ruby2.7source(unstable)(unfixed)
ruby3.1source(unstable)(unfixed)

Notes

[bookworm] - jruby <no-dsa> (Minor issue)
Fixed by: https://github.com/ruby/ruby/commit/957bb7cb81995f26c671afce0ee50a5c660e540e (v3_1_4)
Fixed by: https://github.com/ruby/time/commit/b57db51f577875d3e896dcd2ef1dcaf97f23e943 (v0.2.2)
Fixed by: https://github.com/ruby/time/commit/3dce6f73d14f5fad6d9b302393fd02df48797b11 (v0.2.2)
https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/

Search for package or bug name: Reporting problems