GHSA-qcm3-vfq5-wfr2

RedCloth Regular Expression Denial of Service issue

Source: GitHub Advisory Database (reviewed) High CVE-2023-31606

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	RedCloth	< 4.3.3	4.3.3

Details

As written in the advisory (Markdown source, shown as plain text).

A Regular Expression Denial of Service (ReDoS) issue was discovered in the `sanitize_html` function of RedCloth gem. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-31606 advisory
https://github.com/jgarber/redcloth/issues/73 web
https://github.com/jgarber/redcloth/commit/8b1327688fef8e6617792054ef299d7bc74c0a1e web
https://github.com/e23e/CVE-2023-31606#readme web
https://github.com/jgarber/redcloth package
https://github.com/jgarber/redcloth/blob/v4.3.2/lib/redcloth/formatters/html.rb#L327 web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/RedCloth/CVE-2023-31606.yml web
https://lists.debian.org/debian-lts-announce/2023/07/msg00002.html web
https://security.gentoo.org/glsa/202401-14 web