GitHub Advisoryadvisory · RubyGems

GHSA-fg7x-g82r-94qc Ruby Time component ReDoS issue

HIGH Published 2023-03-31 Modified 2025-11-04 Official page ↗
Aliases
CVE-2023-28756
Ecosystem
RubyGems
Packages
time
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2023-03-31

Affected packages

• RubyGems time: >= 0.2.0, < 0.2.2 → fixed in 0.2.2 • RubyGems time: < 0.1.1 → fixed in 0.1.1

Description

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

Related

Alias · CVE (1)

  • CVE-2023-28756 A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References