GitHub Advisoryadvisory · RubyGems

GHSA-v6rp-3r3v-hf4p Ruby OpenSSL DoS Vulnerability

HIGH Published 2022-05-14 Modified 2023-10-24 Official page ↗
Aliases
CVE-2017-14033
Ecosystem
RubyGems
Packages
openssl
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-119
Reviewed
2023-07-26

Affected packages

• RubyGems openssl: < 2.0.0 → fixed in 2.0.0

Description

The decode method in the `OpenSSL::ASN1` module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string. The `openssl` gem that contains this module is patched in version 2.0.0.

Related

Alias · CVE (1)

  • CVE-2017-14033 The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a… vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References