A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-pg-docUpgrade rubygem-bundler-docUpgrade ruby-docUpgrade rubygem-mongoUpgrade ruby-bundled-gemsUpgrade rubygem-rbsUpgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-psychUpgrade rubygem-irbUpgrade rubygem-pgUpgrade rubygem-bsonUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygemsUpgrade rubygem-rssUpgrade ruby-default-gemsUpgrade rubygem-opensslUpgrade rubygem-did_you_meanUpgrade ruby-libsUpgrade rubygem-rexmlUpgrade rubygem-typeprofUpgrade ruby-irbUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade rubygem-xmlrpcUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade rubygem-net-telnetUpgrade rubygem-test-unit | Mar 22, 2024 | Jun 29, 2023 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2Upgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-default-gems | Feb 17, 2025 | Jun 29, 2023 |
| Debian | — | Upgrade ruby2.7 | Sep 5, 2024 | Jun 29, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jan 10, 2024 | Jun 29, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Jan 10, 2024 | Jun 29, 2023 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-rssUpgrade rubygem-mongo-docUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-bundler-docUpgrade rubygem-test-unitUpgrade rubygem-typeprofUpgrade rubygem-net-telnetUpgrade rubygem-rexmlUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygemsUpgrade rubygem-bsonUpgrade rubygem-rbsUpgrade ruby-bundled-gemsUpgrade ruby-libsUpgrade rubyUpgrade rubygem-xmlrpcUpgrade rubygem-opensslUpgrade ruby-default-gemsUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade rubygem-mongoUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-bson-docUpgrade ruby-irbUpgrade rubygem-bundler | Mar 21, 2024 | Jun 29, 2023 |
| Redhat_linux | — | Upgrade rubyNo solution existsUpgrade rubygem-mysql2Upgrade rubygem-pg-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-rssUpgrade rubygem-bundlerUpgrade rubygem-rakeUpgrade rubygem-openssl-debuginfoUpgrade rubygem-xmlrpcUpgrade ruby-bundled-gemsUpgrade rubygem-test-unitUpgrade rubygem-io-consoleUpgrade rubygem-irbUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-mysql2-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-abrtUpgrade rubygem-rexmlUpgrade ruby-default-gemsUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-rbsUpgrade rubygem-pg-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-rbs-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-typeprofUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade rubygem-pgUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade ruby-libs-debuginfoUpgrade rubygems-develUpgrade rubygem-abrt-docUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mongoUpgrade ruby-debugsourceUpgrade rubygemsUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-bundler-doc | Mar 20, 2024 | Jun 29, 2023 |
| Rocky_linux | — | Upgrade rubygem-io-consoleUpgrade rubygem-pg-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygem-bsonUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-rbsUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-bson-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade rubygem-io-console-debuginfoUpgrade ruby-libsUpgrade rubygem-bson-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psych | Mar 28, 2024 | Jun 29, 2023 |
| Ubuntu | — | Upgrade ruby3.1Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby3.0Upgrade libruby3.1Upgrade libruby3.0Upgrade ruby2.7Upgrade ruby-bundlerUpgrade ruby2.3 (Ubuntu Pro) | Jul 13, 2023 | Jun 29, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 29, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub