CVE-2023-36617

Medium

Description

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

SeverityMedium

CVSS5.3

Exploit probability—

ProductRuby-lang Uri

PublishedJun 29, 2023

First seenJun 29, 2023

How to fix

Update

ruby-lang uri0.10.3, 0.12.2 or later

Vendor advisories

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/

Affected products

Product	Affected versions	Fixed in
ruby-lang uri	v < 0.10.3, 0.11.0 ≤ v < 0.12.2	0.10.3, 0.12.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.