REDHAT-BUG-470252
First published: Thu Nov 06 2008(Updated: )
Common Vulnerabilities and Exposures assigned an identifier <a href="https://access.redhat.com/security/cve/CVE-2008-3656">CVE-2008-3656</a> to the following vulnerability: Algorithmic complexity vulnerability in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.5 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression. Refences: <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401</a> <a href="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/">http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</a> Vincent Danen from LinSec discovered the original patch for this flaw, provided by Red Hat, did not properly address this flaw.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ruby | <1.8.5>=1.8.5<=1.8.6-p286>=1.8.7<=1.8.7-p71>=1.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2008-3656
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401
- http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=322718&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=322718&action=edit
- https://access.redhat.com/security/cve/CVE-2008-4310
- http://www.openwall.com/lists/oss-security/2008/12/04/2
- http://rhn.redhat.com/errata/RHSA-2008-0981.html
- https://bugzilla.redhat.com/show_bug.cgi?id=470252
Frequently Asked Questions
What is the severity of REDHAT-BUG-470252?
The severity of REDHAT-BUG-470252 is considered moderate due to the algorithmic complexity vulnerability that can lead to denial of service.
How do I fix REDHAT-BUG-470252?
To fix REDHAT-BUG-470252, upgrade Ruby to version 1.8.6-p287 or later, or any version starting from 1.9.
Which Ruby versions are affected by REDHAT-BUG-470252?
Ruby versions 1.8.5 and earlier, as well as 1.8.5 through 1.8.6-p286 and 1.8.7-p71, are affected by REDHAT-BUG-470252.
What type of vulnerability is REDHAT-BUG-470252?
REDHAT-BUG-470252 is an algorithmic complexity vulnerability found in WEBrick's HTTP DefaultFileHandler.
Is REDHAT-BUG-470252 a newly discovered vulnerability?
No, REDHAT-BUG-470252 is an older vulnerability that has been known since 2008.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2008-4310
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/ruby
- canonical/ruby