A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-xmlrpcUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade rubygem-rakeUpgrade rubygem-typeprofUpgrade rubygem-net-telnetUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade rubygem-rdocUpgrade rubygem-rexmlUpgrade rubygem-abrt-docUpgrade rubygem-did_you_meanUpgrade rubygem-rbsUpgrade rubygem-bundler-docUpgrade rubygem-irbUpgrade ruby-default-gemsUpgrade rubygem-opensslUpgrade rubygem-mongo-docUpgrade rubygemsUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-abrtUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-rssUpgrade ruby-docUpgrade rubygem-psychUpgrade ruby-develUpgrade ruby-bundled-gemsUpgrade rubyUpgrade ruby-libsUpgrade rubygem-bsonUpgrade rubygem-mongoUpgrade rubygem-bundler | Mar 22, 2024 | Jun 29, 2023 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygems-develUpgrade ruby3.2Upgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-libsUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-io-console-debuginfo | Feb 17, 2025 | Jun 29, 2023 |
| Debian | — | Upgrade ruby2.7 | Sep 5, 2024 | Jun 29, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jan 10, 2024 | Jun 29, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jan 10, 2024 | Jun 29, 2023 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-typeprofUpgrade rubygem-rexmlUpgrade rubyUpgrade ruby-docUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubygem-pgUpgrade rubygem-xmlrpcUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade rubygem-bsonUpgrade ruby-bundled-gemsUpgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-test-unitUpgrade rubygemsUpgrade rubygem-mysql2Upgrade rubygem-net-telnetUpgrade rubygem-bundler-docUpgrade ruby-libsUpgrade rubygem-rdocUpgrade rubygem-power_assertUpgrade rubygem-opensslUpgrade rubygem-bundlerUpgrade rubygem-did_you_meanUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade ruby-irbUpgrade rubygem-rakeUpgrade ruby-develUpgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-mongoUpgrade rubygem-mysql2-doc | Mar 21, 2024 | Jun 29, 2023 |
| Redhat_linux | — | Upgrade rubyUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-psych-debuginfoUpgrade rubygem-rbsUpgrade rubygem-abrtUpgrade rubygem-pg-debuginfoUpgrade rubygem-opensslUpgrade rubygem-did_you_meanUpgrade rubygem-irbUpgrade rubygem-bsonUpgrade ruby-libsUpgrade ruby-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-xmlrpcUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-bundlerUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-pg-debugsourceUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-rssUpgrade ruby-bundled-gemsUpgrade rubygem-test-unitUpgrade ruby-develNo solution existsUpgrade rubygem-rexmlUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade ruby-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-typeprofUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-irbUpgrade rubygems-develUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfo | Mar 20, 2024 | Jun 29, 2023 |
| Rocky_linux | — | Upgrade rubygem-opensslUpgrade rubygem-pg-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade rubyUpgrade rubygem-jsonUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-libs-debuginfoUpgrade ruby-libsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade rubygem-psychUpgrade rubygem-rbsUpgrade rubygem-bson-debuginfoUpgrade rubygem-bsonUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-rbs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-pg-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade ruby-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debugsource | Mar 28, 2024 | Jun 29, 2023 |
| Ubuntu | — | Upgrade ruby2.7Upgrade ruby-bundlerUpgrade libruby3.0Upgrade libruby3.1Upgrade ruby3.0Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby3.1Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.7Upgrade libruby2.3 (Ubuntu Pro) | Jul 13, 2023 | Jun 29, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 29, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub