git: 81860ddd68cf - main - security/vuxml: Document ReDoS vulnerability in rubygem-uri
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 30 Mar 2023 21:28:18 UTC
The branch main has been updated by yasu:
URL: https://cgit.FreeBSD.org/ports/commit/?id=81860ddd68cf34152d7b695a842b0646ea9b50c5
commit 81860ddd68cf34152d7b695a842b0646ea9b50c5
Author: Yasuhiro Kimura <yasu@FreeBSD.org>
AuthorDate: 2023-03-30 16:43:32 +0000
Commit: Yasuhiro Kimura <yasu@FreeBSD.org>
CommitDate: 2023-03-30 21:27:36 +0000
security/vuxml: Document ReDoS vulnerability in rubygem-uri
---
security/vuxml/vuln/2023.xml | 54 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 54 insertions(+)
diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
index c80eef5326b6..9e0b414465ca 100644
--- a/security/vuxml/vuln/2023.xml
+++ b/security/vuxml/vuln/2023.xml
@@ -1,3 +1,57 @@
+ <vuln vid="9b60bba1-cf18-11ed-bd44-080027f5fec9">
+ <topic>rubygem-uri -- ReDoS vulnerability</topic>
+ <affects>
+ <package>
+ <name>ruby</name>
+ <range><ge>2.7.0,1</ge><lt>2.7.8,1</lt></range>
+ <range><ge>3.0.0,1</ge><lt>3.0.6,1</lt></range>
+ <range><ge>3.1.0,1</ge><lt>3.1.4,1</lt></range>
+ <range><ge>3.2.0.p1,1</ge><lt>3.2.2,1</lt></range>
+ </package>
+ <package>
+ <name>ruby27</name>
+ <range><ge>2.7.0,1</ge><lt>2.7.8,1</lt></range>
+ </package>
+ <package>
+ <name>ruby30</name>
+ <range><ge>3.0.0,1</ge><lt>3.0.6,1</lt></range>
+ </package>
+ <package>
+ <name>ruby31</name>
+ <range><ge>3.1.0,1</ge><lt>3.1.4,1</lt></range>
+ </package>
+ <package>
+ <name>ruby32</name>
+ <range><ge>3.2.0.p1,1</ge><lt>3.2.2,1</lt></range>
+ </package>
+ <package>
+ <name>rubygem-uri</name>
+ <range><lt>0.12.1</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Dominic Couture reports:</p>
+ <blockquote cite="https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/">
+ <p>
+ A ReDoS issue was discovered in the URI component. The URI
+ parser mishandles invalid URLs that have specific
+ characters. It causes an increase in execution time for
+ parsing strings to URI objects.
+ </p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2023-28755</cvename>
+ <url>https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/</url>
+ </references>
+ <dates>
+ <discovery>2023-03-28</discovery>
+ <entry>2023-03-30</entry>
+ </dates>
+ </vuln>
+
<vuln vid="dc33795f-ced7-11ed-b1fe-6805ca2fa271">
<topic>powerdns-recursor -- denial of service</topic>
<affects>