Debian Security Bug TrackerDEBIANCVE:CVE-2024-43380CVE-2024-43380
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
Low
EPSS
Percentile
21.9%
fugit contains time tools for flor and the floraison group. The fugit “natural” parser, that turns “every wednesday at 5pm” into “0 17 * * 3”, accepted any length of input and went on attempting to parse it, not returning promptly, as expected. The parse call could hold the thread with no end in sight. Fugit dependents that do not check (user) input length for plausibility are impacted. A fix was released in fugit 1.11.1.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | ruby-fugit | <= 1.5.2-1 | ruby-fugit_1.5.2-1_all.deb |
| Debian | 11 | all | ruby-fugit | <= 1.3.8-1 | ruby-fugit_1.3.8-1_all.deb |
| Debian | 999 | all | ruby-fugit | <= 1.8.1-3 | ruby-fugit_1.8.1-3_all.deb |
| Debian | 13 | all | ruby-fugit | <= 1.8.1-3 | ruby-fugit_1.8.1-3_all.deb |
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
Low
EPSS
Percentile
21.9%