CVE-2008-3443: Medium severity ruby vulnerability
The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3443?
The severity of CVE-2008-3443 is considered to be high due to its potential to cause denial of service through an infinite loop and crash.
How do I fix CVE-2008-3443?
To fix CVE-2008-3443, you should upgrade your Ruby version to at least 1.8.7-p72 or later, or 1.9.0 and later.
Which versions of Ruby are affected by CVE-2008-3443?
CVE-2008-3443 affects Ruby versions 1.8.5 and earlier, all versions of 1.8.6, 1.8.7 up to 1.8.7-p71, and 1.9 up to r18423.
What kind of attacks can exploit CVE-2008-3443?
CVE-2008-3443 can be exploited by remote attackers who send multiple long requests to a Ruby socket, leading to a denial of service.
Is CVE-2008-3443 a critical vulnerability?
Yes, CVE-2008-3443 is considered critical as it allows remote attackers to crash the application by causing an infinite loop.