Denial-of-Service Vulnerability in ruby-bindata Package
Summary
DEBIAN-CVE-2021-32823: In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. Affects ruby-bindata versions < 2.4.14-1. Fixed in 2.4.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ruby-bindata package is a RubyGem that provides a way to define binary data structures in Ruby. It allows developers to create and manipulate binary data formats easily, making it a valuable tool for applications that require low-level data handling. However, certain versions of this package are vulnerable to a denial-of-service (DoS) attack due to inefficiencies in creating specific classes, which can lead to excessive CPU usage.
Vulnerability Detail
In the bindata RubyGem before version 2.4.10, there exists a potential denial-of-service vulnerability. This issue arises from the slow creation of certain classes in BinData, such as BinData::Bit100000, BinData::Bit100001, and others. When combined with user input that utilizes the constantize method, this can result in a CPU-based DoS attack, severely degrading application performance. The vulnerability was addressed in version 2.4.10, which improved the creation time of Bits and Integers.
How To Fix
Minimum fixed version
2.4.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby-bindataTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the vulnerable classes in BinData with user input that could lead to constantization. This may help mitigate the risk of a DoS attack until the package can be updated.
Conclusion
The ruby-bindata package has a significant denial-of-service vulnerability in versions prior to 2.4.10. It is crucial for developers using this package to update to version 2.4.14-1 or later to mitigate the risk of potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ruby-bindata →
FAQ
ruby-bindata is a RubyGem that allows developers to define and manipulate binary data structures in Ruby applications.
The vulnerability allows for a potential denial-of-service attack due to slow creation times of certain BinData classes, which can lead to excessive CPU usage.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of ruby-bindata before 2.4.10 are affected by this vulnerability.
You can update the package by running 'sudo apt-get update && sudo apt-get install ruby-bindata' in your terminal.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby-bindata.
