Bug 458953 (CVE-2008-3656) - CVE-2008-3656 ruby: WEBrick DoS vulnerability (CPU consumption)
Summary: CVE-2008-3656 ruby: WEBrick DoS vulnerability (CPU consumption)
Keywords:
Status: NEW
Alias: CVE-2008-3656
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://nvd.nist.gov/nvd.cfm?cvename=C...
Whiteboard:
Depends On: 461579 461580 461590 461591
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-08-13 13:49 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:26 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)
Proposed patch (67 bytes, text/plain)
2008-08-13 14:29 UTC, Jan Lieskovsky
no flags Details
Correct patch for this issue (1.11 KB, patch)
2008-11-05 19:59 UTC, Josh Bressers
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2008:0897 normal SHIPPED_LIVE Moderate: ruby security update 2008-10-21 14:43:41 UTC

Description Jan Lieskovsky 2008-08-13 13:49:17 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-3656 to the following vulnerability:

Algorithmic complexity vulnerability in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.5 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.

Refences:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401
http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/

Comment 4 Jan Lieskovsky 2008-08-13 14:29:44 UTC
Created attachment 314212 [details]
Proposed patch

Comment 8 Fedora Update System 2008-10-08 14:20:59 UTC
ruby-1.8.6.287-2.fc8 has been submitted as an update for Fedora 8.
http://admin.fedoraproject.org/updates/ruby-1.8.6.287-2.fc8

Comment 9 Fedora Update System 2008-10-08 14:22:57 UTC
ruby-1.8.6.287-2.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/ruby-1.8.6.287-2.fc9

Comment 10 Fedora Update System 2008-10-09 21:29:23 UTC
ruby-1.8.6.287-2.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2008-10-09 21:35:13 UTC
ruby-1.8.6.287-2.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Josh Bressers 2008-11-05 19:59:29 UTC
Created attachment 322637 [details]
Correct patch for this issue

The previous patch is actually for CVE-2008-1145.

This is the proper patch for CVE-2008-3656


Note You need to log in before you can comment on or make changes to this bug.