CVE-2023-22799: ReDoS based DoS vulnerability in GlobalID
Summary
CVE-2023-22799: ReDoS based DoS vulnerability in GlobalID. Affects globalid versions >= 0.2.1, < 1.0.1. Fixed in 1.0.1. How to fix ↓
Also tracked for
- ruby-globalid · Debian:11
The same CVE-2023-22799 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GlobalID is a RubyGem that provides a simple and efficient way to generate unique identifiers for Active Record models. It is commonly used in Ruby on Rails applications to serialize and deserialize model references. GlobalID allows developers to easily pass around references to models without relying on database-specific identifiers.
The GlobalID gem is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This type of attack occurs when a malicious user provides input that causes a regular expression to take an unexpectedly long time to process. In the case of GlobalID, the vulnerability lies in the model name parsing section of the gem.
This vulnerability has been assigned the CVE identifier CVE-2023-22799.
Vulnerability Detail
The ReDoS vulnerability in GlobalID can be exploited by providing carefully crafted input to the model name parsing section of the gem. This can cause the regular expression engine to enter into an infinite loop, consuming excessive CPU resources and potentially leading to a denial of service (DoS) condition.
The impact of this vulnerability is a possible DoS attack, where an attacker can send malicious requests that cause the application to become unresponsive or crash. This can disrupt the availability of the affected application and potentially impact its users.
The vulnerability affects versions of GlobalID starting from 0.2.1 and is fixed in version 1.0.1.
How To Fix
Minimum fixed version
1.0.1
This is the first release that contains the fix.
gem install globalid -v 1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no feasible workarounds available for this vulnerability. It is recommended to upgrade to the fixed version or apply the provided patches.
Conclusion
The GlobalID gem is vulnerable to a ReDoS based DoS attack, which can be exploited by providing carefully crafted input. This can lead to a denial of service condition, impacting the availability of the affected application. It is crucial to upgrade to the fixed version (1.0.1) or apply the provided patches to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for globalid →
FAQ
GlobalID is a RubyGem that provides a way to generate unique identifiers for Active Record models in Ruby on Rails applications.
A ReDoS vulnerability occurs when a regular expression takes an unexpectedly long time to process, leading to a denial of service condition.
This vulnerability can be exploited by providing carefully crafted input to the model name parsing section of GlobalID.
The impact of this vulnerability is a possible denial of service (DoS) attack, where an attacker can cause the application to become unresponsive or crash.
To fix this vulnerability, it is recommended to upgrade to the fixed version of GlobalID (1.0.1) or apply the provided patches.
Related vulnerabilities
Recent vulnerabilities recorded for globalid.
