Lucene search

K
redosRedosROS-20230929-01
HistorySep 29, 2023 - 12:00 a.m.

ROS-20230929-01

2023-09-2900:00:00
redos.red-soft.ru
10
vulnerability
ruby programming language
nokogiri library
remote attackers
denial of service
invalid urls
null pointer
exploitation

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

36.9%

Vulnerability in the URI component of the Ruby programming language, related to improper handling of invalid
URLs containing certain characters. Exploitation of the vulnerability could allow an attacker,
acting remotely, to cause a denial of service

Vulnerability in the Nokogiri::XML::Reader#attribute_hash method of the Nokogiri library, related to the exclusion of a null pointer when analyzing invalid URLs containing certain characters.
null pointer when analyzing invalid markup. Exploitation of the vulnerability could allow
an attacker acting remotely to cause a denial of service

OSVersionArchitecturePackageVersionFilename
redos7.3x86_64puppet<= 7.26.0-2UNKNOWN

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

36.9%