CVE-2023-36617: Medium severity ruby-lang Uri Ruby vulnerability
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396parser.rb and rfc3986parser.rb.
NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
The Ruby advisory recommends updating the uri gem to 0.12.2. In order to ensure compatibility with the bundled version in older Ruby series, you may update as follows instead: - For Ruby 3.0: Update to uri 0.10.3 - For Ruby 3.1 and 3.2: Update to uri 0.12.2.
You can use gem update uri to update it. If you are using bundler, please add gem uri, >= 0.12.2 (or other version mentioned above) to your Gemfile.
Other sources
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396parser.rb and rfc3986parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/urito a version that resolves this vulnerability.Fixed in 0.10.0.3 - Upgrade
Upgrade
rubygems/urito a version that resolves this vulnerability.Fixed in 0.11.2 - Upgrade
Upgrade
rubygems/urito a version that resolves this vulnerability.Fixed in 0.12.2 - Upgrade
Upgrade
rubygems/urito a version that resolves this vulnerability.Fixed in 0.10.3 - Upgrade
Upgrade
debian/jrubyto a version that resolves this vulnerability.Fixed in 9.3.9.0+ds-8Fixed in 9.4.8.0+ds-2 - Upgrade
Upgrade
debian/ruby2.7to a version that resolves this vulnerability.Fixed in 2.7.4-1+deb11u5 - Upgrade
Upgrade
debian/ruby3.1to a version that resolves this vulnerability.Fixed in 3.1.2-7+deb12u1Fixed in 3.1.2-8.5 - Upgrade
Upgrade
debian/rubygemsto a version that resolves this vulnerability.Fixed in 3.2.5-2Fixed in 3.3.15-2Fixed in 3.6.7-2 - Upgrade
Upgrade
redhat/rubygem-urito a version that resolves this vulnerability.Fixed in 0.12.2 - Upgrade
Upgrade
redhat/rubygem-urito a version that resolves this vulnerability.Fixed in 0.10.3 - Upgrade
Upgrade
uri gemto a version that resolves this vulnerability.Fixed in 0.10.3 - Upgrade
Upgrade
uri gemto a version that resolves this vulnerability.Fixed in 0.12.2
Event History
Frequently Asked Questions
What is CVE-2023-36617?
CVE-2023-36617 is a ReDoS vulnerability in the URI component before version 0.12.2 for Ruby.
How does the URI parser mishandle invalid URLs?
The URI parser mishandles invalid URLs that have specific characters, leading to an increase in execution time.
What is the severity of CVE-2023-36617?
CVE-2023-36617 has a severity rating of medium (5.3).
What is the CWE ID for CVE-2023-36617?
The CWE ID for CVE-2023-36617 is 1333.
How can I fix CVE-2023-36617?
To fix CVE-2023-36617, update the URI component to version 0.12.2 or later for Ruby.