~ / search / GHSA-hv5j-3h9f-99c2

GHSA-hv5j-3h9f-99c2

Ruby URI component ReDoS issue

Source: GitHub Advisory Database (reviewed) High CVE-2023-28755

Packages

EcosystemPackageAffectedFixed in
RubyGems uri >= 0.12.0, < 0.12.1 0.12.1
RubyGems uri >= 0.11.0, < 0.11.1 0.11.1
RubyGems uri >= 0.10.1, < 0.10.2 0.10.2
RubyGems uri < 0.10.0.1 0.10.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

References

External links from the advisory. They lead to third-party sites.