A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygem-abrt-docUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-rexmlUpgrade rubygem-mysql2-docUpgrade rubygem-net-telnetUpgrade rubygem-xmlrpcUpgrade rubygem-typeprofUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-bson-docUpgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-rssUpgrade rubygem-bundler-docUpgrade ruby-bundled-gemsUpgrade rubygem-mongoUpgrade rubygem-psychUpgrade ruby-default-gemsUpgrade rubygem-bsonUpgrade rubygem-rbsUpgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubyUpgrade rubygem-irbUpgrade rubygem-pgUpgrade rubygem-did_you_meanUpgrade rubygemsUpgrade rubygem-opensslUpgrade ruby-libs | Mar 22, 2024 | Jun 29, 2023 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2Upgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-default-gems | Feb 17, 2025 | Jun 29, 2023 |
| Debian | — | Upgrade ruby2.7 | Sep 5, 2024 | Jun 29, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jan 10, 2024 | Jun 29, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Jan 10, 2024 | Jun 29, 2023 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade ruby-default-gemsUpgrade rubygem-rakeUpgrade rubygem-mongoUpgrade rubygem-pg-docUpgrade rubygem-minitestUpgrade rubygem-mysql2-docUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-bson-docUpgrade rubygem-io-consoleUpgrade rubygem-opensslUpgrade ruby-irbUpgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade rubygem-rdocUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade rubygem-bundler-docUpgrade ruby-docUpgrade rubygem-pgUpgrade rubygem-jsonUpgrade rubygem-typeprofUpgrade rubygem-rexmlUpgrade rubygem-xmlrpcUpgrade rubygem-bsonUpgrade rubygem-rbsUpgrade rubyUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade rubygem-net-telnetUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade ruby-bundled-gemsUpgrade rubygemsUpgrade rubygem-mongo-doc | Mar 21, 2024 | Jun 29, 2023 |
| Redhat_linux | — | Upgrade rubygem-pg-docUpgrade rubygemsUpgrade rubygem-bson-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-json-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bundler-docUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade ruby-irbUpgrade rubygem-net-telnetUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade ruby-libs-debuginfoUpgrade rubygem-minitestUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-typeprofUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-jsonUpgrade rubygem-opensslUpgrade rubygem-did_you_meanUpgrade rubygem-bsonUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-irbUpgrade rubygem-rssUpgrade ruby-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubygem-mongo-docUpgrade rubygem-mysql2Upgrade ruby-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rexmlUpgrade rubygem-io-consoleUpgrade rubygem-abrtUpgrade rubygem-rakeNo solution existsUpgrade rubygem-rbsUpgrade ruby-bundled-gemsUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade rubygem-openssl-debuginfoUpgrade rubygem-xmlrpcUpgrade ruby-libsUpgrade ruby | Mar 20, 2024 | Jun 29, 2023 |
| Rocky_linux | — | Upgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bsonUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade ruby-bundled-gemsUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bson-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-rbsUpgrade rubygem-bson-debuginfoUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade rubygem-psychUpgrade ruby-libs-debuginfoUpgrade rubygem-json | Mar 28, 2024 | Jun 29, 2023 |
| Ubuntu | — | Upgrade libruby2.7Upgrade ruby3.1Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.0Upgrade libruby3.1Upgrade ruby-bundlerUpgrade ruby3.0Upgrade ruby2.7Upgrade ruby2.3 (Ubuntu Pro) | Jul 13, 2023 | Jun 29, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 29, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub