Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALASRUBY3.0-2023-001

Related Vulnerabilities: CVE-2023-28755   CVE-2023-28756  

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. (CVE-2023-28755) A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. (CVE-2023-28756)

Source

ALASRUBY3.0-2023-001

Amazon Linux 2 Security Advisory: ALASRUBY3.0-2023-001
Advisory Release Date: 2023-08-04 20:34 Pacific
Advisory Updated Date: 2023-09-25 22:01 Pacific
Severity: Important
Issue Overview:

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. (CVE-2023-28755)

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. (CVE-2023-28756)


Affected Packages:

ruby


Issue Correction:
Run yum update ruby to update your system.

New Packages:
aarch64:
    ruby-3.0.6-156.amzn2.0.1.aarch64
    ruby-devel-3.0.6-156.amzn2.0.1.aarch64
    ruby-libs-3.0.6-156.amzn2.0.1.aarch64
    rubygem-bigdecimal-3.0.0-156.amzn2.0.1.aarch64
    rubygem-io-console-0.5.7-156.amzn2.0.1.aarch64
    rubygem-json-2.5.1-156.amzn2.0.1.aarch64
    rubygem-psych-3.3.2-156.amzn2.0.1.aarch64
    ruby-debuginfo-3.0.6-156.amzn2.0.1.aarch64

noarch:
    rubygems-3.2.33-156.amzn2.0.1.noarch
    rubygems-devel-3.2.33-156.amzn2.0.1.noarch
    ruby-default-gems-3.0.6-156.amzn2.0.1.noarch
    rubygem-irb-1.3.5-156.amzn2.0.1.noarch
    rubygem-rdoc-6.3.3-156.amzn2.0.1.noarch
    ruby-doc-3.0.6-156.amzn2.0.1.noarch
    rubygem-bundler-2.2.33-156.amzn2.0.1.noarch
    rubygem-minitest-5.14.2-156.amzn2.0.1.noarch
    rubygem-power_assert-1.2.0-156.amzn2.0.1.noarch
    rubygem-rake-13.0.3-156.amzn2.0.1.noarch
    rubygem-rbs-1.4.0-156.amzn2.0.1.noarch
    rubygem-test-unit-3.3.7-156.amzn2.0.1.noarch
    rubygem-rexml-3.2.5-156.amzn2.0.1.noarch
    rubygem-rss-0.2.9-156.amzn2.0.1.noarch
    rubygem-typeprof-0.15.2-156.amzn2.0.1.noarch

src:
    ruby-3.0.6-156.amzn2.0.1.src

x86_64:
    ruby-3.0.6-156.amzn2.0.1.x86_64
    ruby-devel-3.0.6-156.amzn2.0.1.x86_64
    ruby-libs-3.0.6-156.amzn2.0.1.x86_64
    rubygem-bigdecimal-3.0.0-156.amzn2.0.1.x86_64
    rubygem-io-console-0.5.7-156.amzn2.0.1.x86_64
    rubygem-json-2.5.1-156.amzn2.0.1.x86_64
    rubygem-psych-3.3.2-156.amzn2.0.1.x86_64
    ruby-debuginfo-3.0.6-156.amzn2.0.1.x86_64

Additional References

Red Hat: CVE-2023-28755, CVE-2023-28756

Mitre: CVE-2023-28755, CVE-2023-28756

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started