CVE-2023-28756: High severity ruby-lang Ruby vulnerability
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
Other sources
The Time parser mishandles invalid strings that have specific characters. It causes an increase in execution time for parsing strings to Time objects.
A ReDoS issue was discovered in the Time gem 0.1.0 and 0.2.1 and Time library of Ruby 2.7.7.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-28756?
CVE-2023-28756 is a ReDoS (Regular Expression Denial of Service) vulnerability discovered in the Time component of Ruby versions up to 3.2.1.
What is the severity of CVE-2023-28756?
CVE-2023-28756 has a severity rating of 7.5 (high).
How does CVE-2023-28756 affect Ruby?
CVE-2023-28756 affects the Time component in Ruby versions up to 3.2.1.
How can I fix CVE-2023-28756?
To fix CVE-2023-28756, you need to upgrade Ruby to version 0.1.1 or version 0.2.2, depending on the affected package.
Where can I find more information about CVE-2023-28756?
You can find more information about CVE-2023-28756 on the official Ruby website.