CVE-2013-4287
RubyGems Regular Expression Denial of Service vulnerability
CVE-2013-4287 is a medium vulnerability (CVSS 4.3) in Ruby-lang Ruby, published October 9, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.33%, the 88th percentile. Fixed in rubygems-update 1.8.23.1.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 3.33%EPSS, 88th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.8.23.1rubygems-update +49 more
Description
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rubygems-updateRubyGems | before 1.8.23.1 | 1.8.23.1 |
rubygems-updateRubyGems | 1.8.24 up to 1.8.26 | 1.8.26 |
rubygems-updateRubyGems | 2.0.0 up to 2.0.8 | 2.0.8 |
rubygems-updateRubyGems | 2.1.0.rc.1 up to 2.1.0 | 2.1.0 |
rubygemsDebian:12 | before 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
rubygemsDebian:13 | before 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
rubygemsDebian:14 | before 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
rubygems-updateRubyGems | before 1.8.23.1, plus listed versions 0.8.100.8.110.8.30.8.40.8.5 Show 45 moreShow less0.8.60.8.80.9.00.9.10.9.20.9.30.9.40.9.51.0.01.0.11.1.01.1.11.2.01.3.01.3.11.3.21.3.31.3.41.3.51.3.61.3.71.4.01.4.11.4.21.5.01.5.21.5.31.6.01.6.11.6.21.7.01.7.11.7.21.8.01.8.11.8.101.8.111.8.121.8.131.8.141.8.151.8.161.8.171.8.181.8.19 | 1.8.23.1 |
rubygems-updateRubyGems | 1.8.24 up to 1.8.26, plus listed versions 1.8.25 | 1.8.26 |
rubygems-updateRubyGems | 2.0.0 up to 2.0.8, plus listed versions 2.0.22.0.32.0.42.0.52.0.62.0.7 | 2.0.8 |
Show 40 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rubygems-updateRubyGems | 2.1.0.rc.1 up to 2.1.0, plus listed versions 2.1.0.rc.2 | 2.1.0 |
ruby-RubyGemsMageia:3 From an advisory covering 2 CVEs | before 1.8.27-1.mga3 | 1.8.27-1.mga3 |
ruby193-rubyRed Hat:rhel_software_collections:1::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-ruby-debuginfoRed Hat:rhel_software_collections:1::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-ruby-develRed Hat:rhel_software_collections:1::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-ruby-docRed Hat:rhel_software_collections:1::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-ruby-irbRed Hat:rhel_software_collections:1::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-ruby-libsRed Hat:rhel_software_collections:1::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-ruby-tcltkRed Hat:rhel_software_collections:1::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-rubygem-bigdecimalRed Hat:rhel_software_collections:1::el6 | before 0:1.1.0-40.el6 | 0:1.1.0-40.el6 |
ruby193-rubygem-io-consoleRed Hat:rhel_software_collections:1::el6 | before 0:0.3-40.el6 | 0:0.3-40.el6 |
ruby193-rubygem-jsonRed Hat:rhel_software_collections:1::el6 | before 0:1.5.5-40.el6 | 0:1.5.5-40.el6 |
ruby193-rubygem-minitestRed Hat:rhel_software_collections:1::el6 | before 0:2.5.1-40.el6 | 0:2.5.1-40.el6 |
ruby193-rubygem-rakeRed Hat:rhel_software_collections:1::el6 | before 0:0.9.2.2-40.el6 | 0:0.9.2.2-40.el6 |
ruby193-rubygem-rdocRed Hat:rhel_software_collections:1::el6 | before 0:3.9.5-40.el6 | 0:3.9.5-40.el6 |
ruby193-rubygemsRed Hat:rhel_software_collections:1::el6 | before 0:1.8.23-40.el6 | 0:1.8.23-40.el6 |
ruby193-rubygems-develRed Hat:rhel_software_collections:1::el6 | before 0:1.8.23-40.el6 | 0:1.8.23-40.el6 |
rubygemsRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs | before 0:1.3.7-4.el6_4 | 0:1.3.7-4.el6_4 |
rubygemsRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs | before 0:1.3.7-4.el6_4 | 0:1.3.7-4.el6_4 |
rubygemsRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs | before 0:1.3.7-4.el6_4 | 0:1.3.7-4.el6_4 |
rubygemsRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs | before 0:1.3.7-4.el6_4 | 0:1.3.7-4.el6_4 |
ruby193-rubyRed Hat:openstack:3::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-ruby-debuginfoRed Hat:openstack:3::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-ruby-develRed Hat:openstack:3::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-ruby-docRed Hat:openstack:3::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-ruby-irbRed Hat:openstack:3::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-ruby-libsRed Hat:openstack:3::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-ruby-tcltkRed Hat:openstack:3::el6 | before 0:1.9.3.448-40.el6 | 0:1.9.3.448-40.el6 |
ruby193-rubygem-bigdecimalRed Hat:openstack:3::el6 | before 0:1.1.0-40.el6 | 0:1.1.0-40.el6 |
ruby193-rubygem-io-consoleRed Hat:openstack:3::el6 | before 0:0.3-40.el6 | 0:0.3-40.el6 |
ruby193-rubygem-jsonRed Hat:openstack:3::el6 | before 0:1.5.5-40.el6 | 0:1.5.5-40.el6 |
ruby193-rubygem-minitestRed Hat:openstack:3::el6 | before 0:2.5.1-40.el6 | 0:2.5.1-40.el6 |
ruby193-rubygem-rakeRed Hat:openstack:3::el6 | before 0:0.9.2.2-40.el6 | 0:0.9.2.2-40.el6 |
ruby193-rubygemsRed Hat:openstack:3::el6 | before 0:1.8.24-9.el6ost | 0:1.8.24-9.el6ost |
ruby193-rubygems-develRed Hat:openstack:3::el6 | before 0:1.8.24-9.el6ost | 0:1.8.24-9.el6ost |
rubygemsRed Hat:enterprise_mrg:2:computenode:el6 From an advisory covering 7 CVEs | before 0:1.8.23.2-1.el6 | 0:1.8.23.2-1.el6 |
cuminRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 7 CVEs | before 0:0.1.5787-4.el6 | 0:0.1.5787-4.el6 |
rubygemsRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 7 CVEs | before 0:1.8.23.2-1.el6 | 0:1.8.23.2-1.el6 |
rubygemsRed Hat:openshift:2.0::el6 | before 0:1.8.24-5.el6op | 0:1.8.24-5.el6op |
rubygems-develRed Hat:openshift:2.0::el6 | before 0:1.8.24-5.el6op | 0:1.8.24-5.el6op |
What each source reports
NVD Score used
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
- Record
CVE-2013-4287- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE ListNo score
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
- Record
CVE-2013-4287- Updated
- 2026-11-02
EUVDEUVD-2022-3399No score
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
- Record
EUVD-2022-3399- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9j7m-rjqx-48vhNo score
RubyGems Regular Expression Denial of Service vulnerability
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
- Record
GHSA-9j7m-rjqx-48vh- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVNo score
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
- Record
CVE-2013-4287- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4287No score
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
- Record
DEBIAN-CVE-2013-4287- Updated
- 2026-11-02
OSVGHSA-9j7m-rjqx-48vhNo score
RubyGems Regular Expression Denial of Service vulnerability
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
- Record
GHSA-9j7m-rjqx-48vh- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVMGASA-2013-0297No score
Updated ruby-RubyGems package fixes security vulnerabilies
Updated ruby-RubyGems package fixes security vulnerability:
RubyGems validates versions with a regular expression that is vulnerable to denial of service due to a backtracking regular expression. For specially crafted RubyGems versions attackers can cause denial of service through CPU consumption (CVE-2013-4287, CVE-2013-4363).
- Record
MGASA-2013-0297- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openwall.com/lists/oss-security/2013/09/10/1
secunia.com/advisories/55381
rhn.redhat.com/errata/RHSA-2013-1523.html
blog.rubygems.org/2013/09/09/CVE-2013-4287.html
puppet.com/security/cve/cve-2013-4287
Show 55 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-4287
github.com/rubygems/rubygems/commit/938a7e31ac73655845ab9045629ff3f580a125da
web.archive.org/web/20160806152839/https://puppet.com/security/cve/cve-2013-4287
security-tracker.debian.org/tracker/CVE-2013-4287
advisories.mageia.org/MGASA-2013-0297.html
bugs.mageia.org/show_bug.cgi?id=11276
lists.fedoraproject.org/pipermail/package-announce/2013-September/115886.html
bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4287
access.redhat.com/errata/RHSA-2013:1427
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1427.json
cve.org/CVERecord?id=CVE-2013-4287
Left out here: 12 versions. The JSON record has them.