|
Vulnerabilities
< Back

CVE-2023-28756

Updated on 31 Mar 2023

Severity

5.3 Medium severity

Details

CVSS score
5.3
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

Details

Affected product:
AlmaLinux 9.2 ESU , Alpine Linux 3.22 , CentOS 7 ELS , Debian 11 , Debian 12 , Debian 13 , EL 10 , EL 8 , EL 9 , Ubuntu 22.04 , Ubuntu 24.04
Affected packages:
ruby @ 2.6 (+14 more)
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

Fixes