CVE-2023-31606

NameCVE-2023-31606
DescriptionA Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3480-1
Debian Bugs1040488

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ruby-redcloth (PTS)buster, bullseye4.3.2-3vulnerable
buster (security)4.3.2-3+deb10u1fixed
bookworm4.3.2-4vulnerable
sid, trixie4.3.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ruby-redclothsourcebuster4.3.2-3+deb10u1DLA-3480-1
ruby-redclothsource(unstable)4.3.3-11040488

Notes

[bookworm] - ruby-redcloth <no-dsa> (Minor issue)
[bullseye] - ruby-redcloth <no-dsa> (Minor issue)
https://github.com/jgarber/redcloth/issues/73
https://github.com/jgarber/redcloth/pull/75
https://github.com/jgarber/redcloth/commit/8b1327688fef8e6617792054ef299d7bc74c0a1e (v4.3.3)
https://github.com/e23e/CVE-2023-31606#readme

Search for package or bug name: Reporting problems