CVE-2023-36617

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/
https://security.netapp.com/advisory/ntap-20230725-0002/
https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ruby-lang:uri::::::ruby::*
	cpe:2.3:a:ruby-lang:uri::::::ruby::*

History

04 May 2024, 03:15

Type	Values Removed	Values Added
References		() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/ -

04 May 2024, 02:15

Type	Values Removed	Values Added
References		() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/ -

25 Jul 2023, 15:15

Type	Values Removed	Values Added
References		(CONFIRM) https://security.netapp.com/advisory/ntap-20230725-0002/ -

06 Jul 2023, 18:34

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
CPE		cpe:2.3:a:ruby-lang:uri::::::ruby::*
CWE		CWE-1333
References	~~(MISC) https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/ -~~	(MISC) https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/ - Mitigation, Vendor Advisory
First Time		Ruby-lang uri Ruby-lang

29 Jun 2023, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-06-29 13:15

Updated : 2024-05-04 03:15

NVD link : CVE-2023-36617

Mitre link : CVE-2023-36617

CVE.ORG link : CVE-2023-36617

JSON object : View

Products Affected

ruby-lang

CWE

CWE-1333

Inefficient Regular Expression Complexity

5.3 /10