GHSA-8vfg-2r28-hvhj: Crass: Non-ASCII characters cause superlinear CPU consumption
Impact
When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption and potentially denial of service.
Patches
This is fixed in Crass 1.0.7.
Workarounds
Avoid passing non-ASCII input to Crass. Or cultivate patience.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
Crassto a version that resolves this vulnerability.Fixed in 1.0.7 - Compensating control
Avoid passing non-ASCII input to Crass.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that pass attacker-controlled input containing non-ASCII characters to Crass are exposed to excessive CPU consumption. The impact may include denial of service through superlinear parsing time.
What does an attacker need to exploit it?
An attacker needs to provide input containing many non-ASCII characters for Crass to parse. No privileges or user interaction are indicated by the provided severity vector.
Which versions contain the fix?
The issue is fixed in Crass 1.0.7.
What can be done if upgrading is not immediately possible?
Avoid passing non-ASCII input to Crass. This reduces exposure to the inefficient multi-byte character position tracking behavior.