Bug 2184061 (CVE-2023-28756)
| Summary: | CVE-2023-28756 ruby: ReDoS vulnerability in Time | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marco Benatto <mbenatto> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | hhorak, jorton, ruby-maint |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in the Time gem and Time library of Ruby. The Time parser mishandles invalid strings with specific characters and causes an increase in execution time for parsing strings to Time objects. This issue may result in a Regular expression denial of service (ReDoS).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-06-27 19:33:41 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2186597, 2186598, 2186599, 2186600, 2187309, 2187500, 2187501, 2187502, 2187503, 2187504, 2189466 | ||
| Bug Blocks: | 2184057 | ||
|
Description
Marco Benatto
2023-04-03 14:35:45 UTC
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Via RHSA-2023:3291 https://access.redhat.com/errata/RHSA-2023:3291 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:3821 https://access.redhat.com/errata/RHSA-2023:3821 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2023-28756 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:7025 https://access.redhat.com/errata/RHSA-2023:7025 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:1431 https://access.redhat.com/errata/RHSA-2024:1431 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:1576 https://access.redhat.com/errata/RHSA-2024:1576 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:3500 https://access.redhat.com/errata/RHSA-2024:3500 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:3838 https://access.redhat.com/errata/RHSA-2024:3838 |