CVE-2021-32740: Regular Expression Denial of Service in Addressable templates
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/addressableto a version that resolves this vulnerability.Fixed in 2.8.0 - Upgrade
Upgrade
addressableto a version that resolves this vulnerability.Fixed in 2.8.0Patch GHSA-jxhc-q857-3j6g - Configuration
As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.
Addressable URI template Template source trust policy = trusted-only
Event History
Frequently Asked Questions
Which uses of Addressable are affected?
Applications are exposed only if they use Addressable URI template functionality and create or match Template objects using attacker-controlled templates. Applications that use Addressable only for URI parsing are unaffected.
What must an attacker control to trigger the denial of service?
An attacker needs to supply a maliciously crafted URI template that is subsequently matched against a URI. Exploitation does not require authentication or user interaction according to the provided CVSS vector.
What remediation or interim mitigation is available?
Affected releases are after 2.3.0 through 2.7.0, and the issue is patched in 2.8.0. If an immediate upgrade is not possible, create Template objects only from trusted sources and validate templates to ensure they do not cause catastrophic backtracking.