Vulnerability in ruby2.5 - Regular Expression Denial of Service (ReDoS)
Summary
DLA-3447-1: ruby2.5 - security update. Affects ruby2.5 versions < 2.5.5-3+deb10u5. Fixed in 2.5.5-3+deb10u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ruby2.5 is a programming language widely used for web development and scripting. It provides a rich set of features and libraries for building applications. However, a vulnerability has been discovered in ruby2.5 that could lead to a Denial of Service (DoS) attack. This vulnerability affects the URI component and the Time module in Ruby, allowing an attacker to exploit specific characters in URLs and cause a significant increase in execution time, potentially impacting the performance of the application.
Vulnerability Detail
The vulnerability, identified as CVE-2023-28755 and CVE-2023-28756, is a Regular Expression Denial of Service (ReDoS) issue. In the URI component, the parser mishandles invalid URLs with certain characters, leading to a slowdown in parsing strings to URI objects. Similarly, in the Time module, the parser mishandles invalid URLs with specific characters, resulting in a delay in parsing strings to Time objects. These vulnerabilities can be exploited by an attacker to cause a significant increase in execution time, potentially leading to a DoS attack.
How To Fix
Minimum fixed version
2.5.5-3+deb10u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. The recommended solution is to apply the security update mentioned above.
Conclusion
The vulnerability in ruby2.5 allows for Regular Expression Denial of Service (ReDoS) attacks through the URI component and the Time module. It is crucial to upgrade to the fixed version of ruby2.5 (2.5.5-3+deb10u5) to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby2.5 →
FAQ
This vulnerability can be exploited by an attacker to cause a significant increase in execution time, potentially leading to a Denial of Service (DoS) attack. It may impact the performance and availability of the affected application.
The vulnerability affects ruby2.5 versions through 3.2.1.
There are no known exploits for this vulnerability at the moment. However, it is important to apply the security update to mitigate the risk.
Yes, the fix for this vulnerability is available in version 2.5.5-3+deb10u5 of the ruby2.5 package for Debian 10 Buster.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS wiki.
Related vulnerabilities
Recent vulnerabilities recorded for ruby2.5.
