CVE-2023-22796: High severity Activesupport Project Activesupport Ruby vulnerability
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.
Other sources
A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.
This affects String#underscore, ActiveSupport::Inflector.underscore, String#titleize, and any other methods using these.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/activesupportto a version that resolves this vulnerability.Fixed in 6.1.7.1 - Upgrade
Upgrade
rubygems/activesupportto a version that resolves this vulnerability.Fixed in 7.0.4.1 - Upgrade
Upgrade
redhat/rubygem-activerecordto a version that resolves this vulnerability.Fixed in 6.1.7.1 - Upgrade
Upgrade
redhat/rubygem-activerecordto a version that resolves this vulnerability.Fixed in 7.0.4.1 - Upgrade
Upgrade
debian/railsto a version that resolves this vulnerability.Fixed in 2:6.1.7.10+dfsg-1~deb12u2Fixed in 2:6.1.7.10+dfsg-1~deb12u3Fixed in 2:7.2.2.2+dfsg-2~deb13u1Fixed in 2:7.2.2.2+dfsg-2~deb13u2Fixed in 2:7.2.4+dfsg-1Fixed in 2:7.2.4+dfsg-2 - Upgrade
Upgrade
alpine/ruby-activesupportto a version that resolves this vulnerability.Fixed in 7.0.4.3-r0 - Upgrade
Upgrade
Active Supportto a version that resolves this vulnerability.Fixed in 5.2.8.15 - Upgrade
Upgrade
Active Supportto a version that resolves this vulnerability.Fixed in 6.1.7.1Patch 6-1-Avoid-regex-backtracking-in-Inflector.underscore.patch - Upgrade
Upgrade
Active Supportto a version that resolves this vulnerability.Fixed in 7.0.4.1Patch 7-0-Avoid-regex-backtracking-in-Inflector.underscore.patch
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-22796.
What is the severity level of CVE-2023-22796?
The severity level of CVE-2023-22796 is high, with a severity value of 7.5.
Which versions of Active Support are affected?
Versions of Active Support <6.1.7.1 and <7.0.4.1 are affected.
How can I fix CVE-2023-22796?
You can fix CVE-2023-22796 by updating to one of the fixed versions: 5.2.8.15 (Rails LTS), 6.1.7.1, or 7.0.4.1.
Where can I find more information about CVE-2023-22796?
You can find more information about CVE-2023-22796 in the following references: [GitHub](https://github.com/rails/rails/releases/tag/v7.0.4.1), [Ruby Advisory DB](https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2023-22796.yml), [Ruby on Rails blog](https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released).