CVE-2023-31606: High severity Promptworks Redcloth Ruby vulnerability
A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitizehtml function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ruby-redclothto a version that resolves this vulnerability.Fixed in 4.3.2-3+ - Upgrade
Upgrade
ubuntu/ruby-redclothto a version that resolves this vulnerability.Fixed in 4.3.2-4ubuntu0.22.04.1 - Upgrade
Upgrade
ubuntu/ruby-redclothto a version that resolves this vulnerability.Fixed in 4.3.2-4ubuntu0.23.04.1 - Upgrade
Upgrade
ubuntu/ruby-redclothto a version that resolves this vulnerability.Fixed in 4.2.9-5ubuntu0.1~ - Upgrade
Upgrade
ubuntu/ruby-redclothto a version that resolves this vulnerability.Fixed in 4.3.2-3ubuntu0.1~ - Upgrade
Upgrade
debian/ruby-redclothto a version that resolves this vulnerability.Fixed in 4.3.2-3+deb10u1Fixed in 4.3.3-1
Event History
Frequently Asked Questions
What is CVE-2023-31606?
CVE-2023-31606 is a Regular Expression Denial of Service (ReDoS) issue discovered in the sanitize_html function of the redcloth gem v4.0.0.
How does CVE-2023-31606 impact the system?
CVE-2023-31606 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.
Which versions of ruby-redcloth are affected by CVE-2023-31606?
ruby-redcloth versions 4.3.2-3 and 4.3.2-4 are affected by CVE-2023-31606.
How can I fix CVE-2023-31606?
To fix CVE-2023-31606, update ruby-redcloth to version 4.3.2-3+deb10u1 or higher.
Where can I find more information about CVE-2023-31606?
You can find more information about CVE-2023-31606 at the following references: [GitHub](https://github.com/e23e/CVE-2023-31606#readme), [GitHub](https://github.com/jgarber/redcloth), [GitHub](https://github.com/jgarber/redcloth/issues/73).