Denial of Service Vulnerability in ruby-redcloth Package: CVE-2023-31606
Summary
DEBIAN-CVE-2023-31606: A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. Affects ruby-redcloth versions < 4.3.3-1. Fixed in 4.3.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ruby-redcloth package is a Ruby library that provides a simple way to convert text to HTML. It is widely used in web applications for formatting and sanitizing user input. The package is designed to handle various text formats and ensure that the output is safe for web use. However, it has been found to be vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can be exploited by attackers to disrupt service availability.
Vulnerability Detail
A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of the redcloth gem version 4.0.0. This vulnerability allows attackers to craft specific payloads that can cause excessive backtracking in regular expressions, leading to significant delays in processing. As a result, an attacker can exploit this vulnerability to cause a Denial of Service (DoS), rendering the application unresponsive and affecting its availability.
How To Fix
Minimum fixed version
4.3.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby-redclothTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to restrict the types of input that can be processed by the sanitize_html function. This can help mitigate the risk of exploitation.
Conclusion
The ruby-redcloth package has a critical vulnerability (CVE-2023-31606) that can lead to Denial of Service attacks. It is essential for users to update to the patched version 4.3.3-1 to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for ruby-redcloth →
FAQ
CVE-2023-31606 is a vulnerability in the ruby-redcloth package that allows for Denial of Service attacks through crafted payloads.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to Denial of Service, making the application unresponsive and affecting user experience.
Yes, the patched version of the ruby-redcloth package is 4.3.3-1. Updating to this version will resolve the vulnerability.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby-redcloth.
