VulnerabilityModified
CVE-2023-28756
It causes an increase in execution time for parsing strings to Time objects.
MEDIUM 5.3EPSS 2.45%
Does this matter?
Lower severity and a low EPSS score (2.45%). Track it; it rarely justifies an emergency change on its own.
Description
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS
- 2.45% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1333
- Affected
- ruby-lang/ruby · ruby-lang/time · debian/debian linux · fedoraproject/fedora
- Source
- cve@mitre.org
References
- https://github.com/ruby/time/releases/Release Notes
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/
- https://security.gentoo.org/glsa/202401-27
- https://security.netapp.com/advisory/ntap-20230526-0004/Third Party Advisory
- https://www.ruby-lang.org/en/downloads/releases/Release Notes
- https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/Release Notes
- https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/Vendor Advisory
- https://github.com/ruby/time/releases/Release Notes
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/
- https://security.gentoo.org/glsa/202401-27
- https://security.netapp.com/advisory/ntap-20230526-0004/Third Party Advisory
- https://www.ruby-lang.org/en/downloads/releases/Release Notes
- https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/Release Notes
- https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.