CVE-2023-28756

NameCVE-2023-28756
DescriptionA ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3408-1, DLA-3447-1, DLA-3858-1, ELA-1148-1, ELA-1149-1
Debian Bugs1036283, 1038408

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
jruby (PTS)jessie, jessie (lts)1.5.6-9+deb8u2vulnerable
stretch (security), stretch (lts), stretch1.7.26-1+deb9u3vulnerable
buster (security), buster, buster (lts)9.1.17.0-3+deb10u1fixed
bookworm9.3.9.0+ds-8vulnerable
sid, trixie9.4.8.0+ds-1fixed
ruby2.1 (PTS)jessie, jessie (lts)2.1.5-2+deb8u14fixed
ruby2.3 (PTS)stretch (security)2.3.3-1+deb9u11vulnerable
stretch (lts), stretch2.3.3-1+deb9u12fixed
ruby2.5 (PTS)buster, buster (lts)2.5.5-3+deb10u7fixed
buster (security)2.5.5-3+deb10u6fixed
ruby2.7 (PTS)bullseye2.7.4-1+deb11u1vulnerable
bullseye (security)2.7.4-1+deb11u2fixed
ruby3.1 (PTS)bookworm (security), bookworm3.1.2-7+deb12u1vulnerable
sid, trixie3.1.2-8.4vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jrubysourceexperimental9.4.3.0+ds-1~exp1
jrubysourcejessie(unfixed)end-of-life
jrubysourcestretch(unfixed)end-of-life
jrubysourcebuster9.1.17.0-3+deb10u1DLA-3408-1
jrubysource(unstable)9.4.5.0+ds-11036283
ruby2.1sourcejessie2.1.5-2+deb8u14ELA-1148-1
ruby2.1source(unstable)(unfixed)
ruby2.3sourcestretch2.3.3-1+deb9u12ELA-1149-1
ruby2.3source(unstable)(unfixed)
ruby2.5sourcebuster2.5.5-3+deb10u5DLA-3447-1
ruby2.5source(unstable)(unfixed)
ruby2.7sourcebullseye2.7.4-1+deb11u2DLA-3858-1
ruby2.7source(unstable)(unfixed)
ruby3.1source(unstable)(unfixed)1038408

Notes

[bookworm] - ruby3.1 <no-dsa> (Minor issue)
[bookworm] - jruby <ignored> (Minor issue)
Fixed by: https://github.com/ruby/ruby/commit/957bb7cb81995f26c671afce0ee50a5c660e540e (v3_1_4)
Fixed by: https://github.com/ruby/time/commit/b57db51f577875d3e896dcd2ef1dcaf97f23e943 (v0.2.2)
Fixed by: https://github.com/ruby/time/commit/3dce6f73d14f5fad6d9b302393fd02df48797b11 (v0.2.2)
https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/
https://github.com/jruby/jruby/commit/36637a1b4e434cbb75c8f87be128b7763cedf99d (9.4.3.0)

Search for package or bug name: Reporting problems