GHSA-hww2-5g85-429m

Suggest an improvement
Source
https://github.com/advisories/GHSA-hww2-5g85-429m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-hww2-5g85-429m/GHSA-hww2-5g85-429m.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-hww2-5g85-429m
Aliases
Related
Published
2023-06-29T15:30:34Z
Modified
2024-09-11T06:12:57.606504Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
URI gem has ReDoS vulnerability
Details

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb.

NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

The Ruby advisory recommends updating the uri gem to 0.12.2. In order to ensure compatibility with the bundled version in older Ruby series, you may update as follows instead: - For Ruby 3.0: Update to uri 0.10.3 - For Ruby 3.1 and 3.2: Update to uri 0.12.2.

You can use gem update uri to update it. If you are using bundler, please add gem uri, >= 0.12.2 (or other version mentioned above) to your Gemfile.

Database specific
{
    "nvd_published_at": "2023-06-29T13:15:09Z",
    "cwe_ids": [
        "CWE-1333"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-14T21:52:02Z"
}
References

Affected packages

RubyGems / uri

Package

Name
uri
Purl
pkg:gem/uri

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.10.1
Fixed
0.10.3

Affected versions

0.*

0.10.1
0.10.2

RubyGems / uri

Package

Name
uri
Purl
pkg:gem/uri

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.12.0
Fixed
0.12.2

Affected versions

0.*

0.12.0
0.12.1

RubyGems / uri

Package

Name
uri
Purl
pkg:gem/uri

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.11.0
Fixed
0.11.2

Affected versions

0.*

0.11.0
0.11.1

RubyGems / uri

Package

Name
uri
Purl
pkg:gem/uri

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.10.0.3

Affected versions

0.*

0.10.0
0.10.0.1
0.10.0.2