GitHub Advisoryadvisory · RubyGems

GHSA-jrfj-98qg-qjgv Denial of service in sidekiq

HIGH Published 2022-01-27 Modified 2023-01-24 Official page ↗
Aliases
CVE-2022-23837
Ecosystem
RubyGems
Packages
sidekiq
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-770
Reviewed
2022-01-24

Affected packages

• RubyGems sidekiq: >= 6.0.0, < 6.4.0 → fixed in 6.4.0 • RubyGems sidekiq: < 5.2.10 → fixed in 5.2.10

Description

In `api.rb` in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.

Related

Alias · CVE (1)

  • CVE-2022-23837 In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References