medium
5.3
CWE
1333
Advisory Published
Advisory Published
Updated

CVE-2023-36617

First published: Thu Jun 29 2023(Updated: )

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with `rfc2396_parser.rb` and `rfc3986_parser.rb`. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. [The Ruby advisory recommends](https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/) updating the uri gem to 0.12.2. In order to ensure compatibility with the bundled version in older Ruby series, you may update as follows instead: - For Ruby 3.0: Update to uri 0.10.3 - For Ruby 3.1 and 3.2: Update to uri 0.12.2. You can use gem update uri to update it. If you are using bundler, please add gem `uri`, `>= 0.12.2` (or other version mentioned above) to your Gemfile.

Credit: cve@mitre.org cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Ruby-lang Uri<0.10.3
Ruby-lang Uri>=0.11.0<0.12.2
rubygems/uri<0.10.0.3
0.10.0.3
rubygems/uri>=0.11.0<0.11.2
0.11.2
rubygems/uri>=0.12.0<0.12.2
0.12.2
rubygems/uri>=0.10.1<0.10.3
0.10.3
redhat/rubygem-uri<0.12.2
0.12.2
redhat/rubygem-uri<0.10.3
0.10.3
debian/jruby
9.3.9.0+ds-8
9.4.8.0+ds-1
debian/ruby2.7<=2.7.4-1+deb11u1
2.7.4-1+deb11u2
debian/ruby3.1
3.1.2-7+deb12u1
3.1.2-8.4
debian/rubygems
3.2.5-2
3.3.15-2
3.4.20-1

Remedy

https://github.com/rubygems/rubygems/commit/c1dc700861e50ffbce58d5a41d3a4cdf064321c7

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is CVE-2023-36617?

    CVE-2023-36617 is a ReDoS vulnerability in the URI component before version 0.12.2 for Ruby.

  • How does the URI parser mishandle invalid URLs?

    The URI parser mishandles invalid URLs that have specific characters, leading to an increase in execution time.

  • What is the severity of CVE-2023-36617?

    CVE-2023-36617 has a severity rating of medium (5.3).

  • What is the CWE ID for CVE-2023-36617?

    The CWE ID for CVE-2023-36617 is 1333.

  • How can I fix CVE-2023-36617?

    To fix CVE-2023-36617, update the URI component to version 0.12.2 or later for Ruby.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203