~ / search / GHSA-fg7x-g82r-94qc

GHSA-fg7x-g82r-94qc

Ruby Time component ReDoS issue

Source: GitHub Advisory Database (reviewed) High CVE-2023-28756

Packages

EcosystemPackageAffectedFixed in
RubyGems time >= 0.2.0, < 0.2.2 0.2.2
RubyGems time < 0.1.1 0.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

References

External links from the advisory. They lead to third-party sites.