Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2013-4287

Published: 17/10/2013 Updated: 22/04/2019
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Subscribe to Enterprise Linux

Vulnerability Summary

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems prior to 1.8.23.1, 1.8.24 up to and including 1.8.25, 2.0.x prior to 2.0.8, and 2.1.x prior to 2.1.0, as used in Ruby 1.9.0 up to and including 2.0.0p247, allows remote malicious users to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Vulnerable Product Search on Vulmon Subscribe to Product

redhat enterprise linux 6.0

rubygems rubygems 2.0.4

rubygems rubygems 2.0.5

rubygems rubygems 2.0.6

rubygems rubygems 1.8.10

rubygems rubygems 1.8.11

rubygems rubygems 1.8.18

rubygems rubygems 1.8.19

rubygems rubygems 1.8.6

rubygems rubygems 1.8.7

rubygems rubygems 2.1.0

rubygems rubygems 2.0.7

rubygems rubygems 1.8.24

rubygems rubygems 1.8.12

rubygems rubygems 1.8.13

rubygems rubygems 1.8.2

rubygems rubygems 1.8.20

rubygems rubygems 1.8.8

rubygems rubygems 1.8.9

rubygems rubygems 2.0.2

rubygems rubygems 2.0.3

rubygems rubygems 1.8.0

rubygems rubygems 1.8.1

rubygems rubygems 1.8.16

rubygems rubygems 1.8.17

rubygems rubygems 1.8.3

rubygems rubygems 1.8.4

rubygems rubygems 1.8.5

rubygems rubygems 2.0.0

rubygems rubygems 2.0.1

rubygems rubygems 1.8.25

rubygems rubygems

rubygems rubygems 1.8.14

rubygems rubygems 1.8.15

rubygems rubygems 1.8.21

rubygems rubygems 1.8.22

ruby-lang ruby 1.9.3

ruby-lang ruby 2.0

ruby-lang ruby 2.0.0

ruby-lang ruby 1.9.1

ruby-lang ruby 1.9.2

ruby-lang ruby 1.9

Vendor Advisories

Debian CVElist Bug Report Logs: rubygems: CVE-2013-4287: Algorithmic complexity vulnerability in RubyGems 2.0.7 and older
Debian Bug report logs - #722361 rubygems: CVE-2013-4287: Algorithmic complexity vulnerability in RubyGems 207 and older Package: rubygems; Maintainer for rubygems is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Henri Salo <henri@nervfi> Date: Tue, 10 Sep 2013 1 ...
Red Hat: Moderate: Red Hat Enterprise MRG Grid 2.4 security update
Synopsis Moderate: Red Hat Enterprise MRG Grid 24 security update Type/Severity Security Advisory: Moderate Topic Updated Grid component packages that fix multiple security issues are nowavailable for Red Hat Enterprise MRG 24 for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated thi ...
Red Hat: Moderate: rubygems security update
Synopsis Moderate: rubygems security update Type/Severity Security Advisory: Moderate Topic An updated rubygems package that fixes three security issues is nowavailable for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerabi ...
Red Hat: Moderate: ruby193-ruby security update
Synopsis Moderate: ruby193-ruby security update Type/Severity Security Advisory: Moderate Topic Updated ruby193-ruby packages that fix one security issue are now availablefor Red Hat Software Collections 1The Red Hat Security Response Team has rated this update as having moderatesecurity impact A Common V ...
Red Hat: Moderate: ruby193-ruby security update
Synopsis Moderate: ruby193-ruby security update Type/Severity Security Advisory: Moderate Topic Updated ruby193-ruby packages that fix one security issue are now availablefor Red Hat OpenStack 30The Red Hat Security Response Team has rated this update as having moderatesecurity impact A Common Vulnerabil ...
Amazon Linux AMI: ALAS-2013-230
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/versionrb in RubyGems before 18231, 1824 through 1825, 20x before 208, and 21x before 210, as used in Ruby 190 through 200p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a lar ...
Red Hat: CVE-2013-4287
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/versionrb in RubyGems before 18231, 1824 through 1825, 20x before 208, and 21x before 210, as used in Ruby 190 through 200p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a lar ...

References

CWE-310http://rhn.redhat.com/errata/RHSA-2013-1427.htmlhttp://blog.rubygems.org/2013/09/09/CVE-2013-4287.htmlhttp://www.openwall.com/lists/oss-security/2013/09/10/1http://secunia.com/advisories/55381http://rhn.redhat.com/errata/RHSA-2013-1441.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1523.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1852.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0207.htmlhttps://puppet.com/security/cve/cve-2013-4287https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=722361https://nvd.nist.govhttps://access.redhat.com/security/cve/cve-2013-4287
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-38028CVE-2024-32406CVE-2024-25624IMAPCVE-2024-2310CVE-2024-0874CVE-2024-20359XXEremote code execution
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook