CVE-2021-41817

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected.

The fix limits the input length up to 128 bytes by default instead of changing the regexps. This is because Date gem uses many Regexps and it is possible that there are still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the limitation by explicitly passing limit keywords as nil like Date.parse(str, limit: nil), but note that it may take a long time to parse.

Please update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later. You can use gem update date to update it. If you are using bundler, please add gem "date", ">= 3.2.1" to your Gemfile. If you import date from the standard library rather than as a gem you should update your Ruby install to 3.0.3, 2.7.5, 2.6.9 or later.

Users unable to upgrade may consider using Date.strptime instead with a predefined date format

Date.strptime('2001-02-20', '%Y-%m-%d')

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).

Security Fix(es):

(CVE-2021-41817)

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)

• rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

• ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

• ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.7.6). (BZ#2109424)

Security Fix(es):

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

• Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.0.4). (BZ#2109431)

Security Fix(es):

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

• Ruby: Double free in Regexp compilation (CVE-2022-28738)

• Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• ruby 3.0: User-installed rubygems plugins are not being loaded [Rocky Linux8] (BZ#2110981)

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)

• rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

• ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

• ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es):

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)
• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.7.6). (BZ#2109424)

Security Fix(es):

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)
• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)
• Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.0.4). (BZ#2109431)

Security Fix(es):

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)
• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)
• Ruby: Double free in Regexp compilation (CVE-2022-28738)
• Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• ruby 3.0: User-installed rubygems plugins are not being loaded [AlmaLinux8] (BZ#2110981)

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

Bundler sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. (CVE-2020-36327)

The REXML gem does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing. (CVE-2021-28965)

In RDoc it is possible to execute arbitrary code via | and tags in a filename. (CVE-2021-31799)

A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). (CVE-2021-31810)

Ruby Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack." (CVE-2021-32066)

Buffer Overrun in CGI.escape_html (CVE-2021-41816)

Regular Expression Denial of Service Vulnerability of Date Parsing Methods (CVE-2021-41817)

Cookie Prefix Spoofing in CGI::Cookie.parse (CVE-2021-41819)

These are all security issues fixed in the libruby2_7-2_7-2.7.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_0-3_0-3.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_1-3_1-3.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_2-3_2-3.2.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_3-3_3-3.3.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby3_4-3_4-3.4.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libruby4_0-4_0-4.0.0~preview2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ruby2.5 fixes the following issues:

• CVE-2022-28739: Fixed a buffer overrun in String-to-Float conversion (bsc#1198441).
• CVE-2021-41817: Fixed a regular expression denial of service in Date Parsing Methods (bsc#1193035).
• CVE-2021-32066: Fixed a StartTLS stripping vulnerability in Net:IMAP (bsc#1188160).
• CVE-2021-31810: Fixed a trusting FTP PASV responses vulnerability in Net:FTP (bsc#1188161).
• CVE-2021-31799: Fixed a command injection vulnerability in RDoc (bsc#1190375).

This update for ruby2.5 fixes the following issues:

• CVE-2023-28755: Fixed a ReDoS vulnerability in URI. (bsc#1209891)
• CVE-2023-28756: Fixed an expensive regexp in the RFC2822 time parser. (bsc#1209967)
• CVE-2021-41817: Fixed a Regular Expression Denial of Service Vulnerability of Date Parsing Methods. (bsc#1193035)
• CVE-2021-33621: Fixed a HTTP response splitting vulnerability in CGI gem. (bsc#1205726)

It was discovered that Ruby incorrectly handled certain HTML files. An attacker could possibly use this issue to cause a crash. This issue only affected Ubuntu 20.04 LTS, Ubuntu 21.04, and Ubuntu 21.10. (CVE-2021-41816)

It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a regular expression denial of service. (CVE-2021-41817)

It was discovered that Ruby incorrectly handled certain cookie names. An attacker could possibly use this issue to access or expose sensitive information. (CVE-2021-41819)