A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-xmlrpcUpgrade rubygem-bson-docUpgrade ruby-irbUpgrade rubygem-mysql2-docUpgrade rubygem-test-unitUpgrade rubygem-net-telnetUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-rexmlUpgrade rubygem-typeprofUpgrade rubygem-io-consoleUpgrade rubygem-irbUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade ruby-libsUpgrade rubygem-abrtUpgrade ruby-default-gemsUpgrade rubygem-bundlerUpgrade ruby-bundled-gemsUpgrade rubygemsUpgrade rubygem-bundler-docUpgrade rubygem-rbsUpgrade rubygem-mongoUpgrade ruby-develUpgrade rubygem-rssUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade ruby-docUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade rubygem-psych | Mar 22, 2024 | Jun 29, 2023 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-default-gemsUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2Upgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-docUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rbs-debuginfo | Feb 17, 2025 | Jun 29, 2023 |
| Debian | — | Upgrade ruby2.7 | Sep 5, 2024 | Jun 29, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jan 10, 2024 | Jun 29, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Jan 10, 2024 | Jun 29, 2023 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-power_assertUpgrade rubygem-did_you_meanUpgrade rubygem-pg-docUpgrade rubygem-opensslUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade ruby-default-gemsUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-rakeUpgrade rubygem-bson-docUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-psychUpgrade rubygem-mongo-docUpgrade rubygem-net-telnetUpgrade rubyUpgrade rubygem-rbsUpgrade rubygem-test-unitUpgrade rubygem-typeprofUpgrade rubygem-rexmlUpgrade rubygem-rssUpgrade rubygem-xmlrpcUpgrade rubygem-jsonUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-bundler-docUpgrade rubygem-bsonUpgrade ruby-docUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade ruby-bundled-gemsUpgrade rubygemsUpgrade rubygem-abrt | Mar 21, 2024 | Jun 29, 2023 |
| Redhat_linux | — | Upgrade rubygem-rbsUpgrade rubygem-bundlerUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-io-consoleNo solution existsUpgrade ruby-default-gemsUpgrade rubygem-psychUpgrade ruby-develUpgrade rubyUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-irbUpgrade rubygem-xmlrpcUpgrade rubygem-pg-debuginfoUpgrade rubygem-rssUpgrade rubygem-jsonUpgrade rubygem-pg-debugsourceUpgrade rubygem-bsonUpgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade rubygem-mongo-docUpgrade ruby-bundled-gemsUpgrade rubygem-psych-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-abrtUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade rubygem-rbs-debuginfoUpgrade rubygemsUpgrade rubygem-mysql2-docUpgrade rubygem-bson-docUpgrade ruby-debugsourceUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-minitestUpgrade rubygem-json-debuginfoUpgrade rubygem-rdocUpgrade rubygem-bundler-docUpgrade rubygem-typeprofUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-mongoUpgrade rubygem-bson-debugsourceUpgrade rubygem-net-telnetUpgrade ruby-irbUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-power_assertUpgrade rubygems-devel | Mar 20, 2024 | Jun 29, 2023 |
| Rocky_linux | — | Upgrade ruby-develUpgrade ruby-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bsonUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-jsonUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bson-debuginfoUpgrade rubygem-rbsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubyUpgrade rubygem-bson-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-pg-debugsource | Mar 28, 2024 | Jun 29, 2023 |
| Ubuntu | — | Upgrade ruby3.0Upgrade ruby2.7Upgrade ruby-bundlerUpgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.0Upgrade libruby3.1Upgrade libruby2.7Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby3.1Upgrade libruby2.5 (Ubuntu Pro) | Jul 13, 2023 | Jun 29, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 29, 2023 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub