CVE-2023-36617

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb.

NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

The Ruby advisory recommends updating the uri gem to 0.12.2. In order to ensure compatibility with the bundled version in older Ruby series, you may update as follows instead:

• For Ruby 3.0: Update to uri 0.10.3
• For Ruby 3.1 and 3.2: Update to uri 0.12.2.

You can use gem update uri to update it. If you are using bundler, please add gem uri, >= 0.12.2 (or other version mentioned above) to your Gemfile.

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).

Security Fix(es):

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.(CVE-2023-36617)

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.1). (Rocky Linux-29052)

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

• ruby: ReDoS vulnerability in URI (CVE-2023-28755)

• ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)

• ruby: ReDoS vulnerability in Time (CVE-2023-28756)

Bug Fix(es):

• ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (Rocky Linux-29048)

• ruby: Ruby cannot read private key in FIPS mode on Rocky Linux 9 (Rocky Linux-12437)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.1). (AlmaLinux-28565)

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
• ruby: ReDoS vulnerability in URI (CVE-2023-28755)
• ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)
• ruby: ReDoS vulnerability in Time (CVE-2023-28756)

Bug Fix(es):

• ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (AlmaLinux-28569)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.1). (AlmaLinux-29052)

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
• ruby: ReDoS vulnerability in URI (CVE-2023-28755)
• ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)
• ruby: ReDoS vulnerability in Time (CVE-2023-28756)

Bug Fix(es):

• ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (AlmaLinux-29048)
• ruby: Ruby cannot read private key in FIPS mode on AlmaLinux 9 (AlmaLinux-12437)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)
• ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)
• ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)
• ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)
• REXML: DoS parsing an XML with many <s in an attribute value (CVE-2024-35176)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2023-36617: fix mishandling invalid URLs that have specific characters in URI parser to prevent ReDoS issue

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (3.1). (Rocky Linux-28565)

Security Fix(es):

• ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

• ruby: ReDoS vulnerability in URI (CVE-2023-28755)

• ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)

• ruby: ReDoS vulnerability in Time (CVE-2023-28756)

Bug Fix(es):

• ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (Rocky Linux-28569)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)

• ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)

• ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)

• ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)

• REXML: DoS parsing an XML with many <s in an attribute value (CVE-2024-35176)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.10 and Ubuntu 20.04 LTS. (CVE-2023-28755)

It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue exists because of an incomplete fix for CVE-2023-28755. (CVE-2023-36617)

It was discovered that RubyGems incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause RubyGems to consume resources, leading to a regular expression denial of service (ReDoS).