CVEvulnerability
CVE-2023-28756
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-03-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-1333
Description
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
Affected configurations
• ruby-lang ruby (<= 2.7.7)
• ruby-lang time 0.1.0
• ruby-lang time 0.2.1
• debian debian linux 10.0
• fedoraproject fedora 36
• fedoraproject fedora 37
• fedoraproject fedora 38
Related
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness
References
- https://github.com/ruby/time/releases/ Release Notes
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202401-27 security.gentoo.org
- https://security.netapp.com/advisory/ntap-20230526-0004/ Third Party Advisory
- https://www.ruby-lang.org/en/downloads/releases/ Release Notes
- https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/ Release Notes
- https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/ Vendor Advisory
- https://github.com/ruby/time/releases/ Release Notes
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html lists.debian.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202401-27 security.gentoo.org
- https://security.netapp.com/advisory/ntap-20230526-0004/ Third Party Advisory
- https://www.ruby-lang.org/en/downloads/releases/ Release Notes
- https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/ Release Notes
- https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/ Vendor Advisory