CVE-2023-36617

CVE-2023-36617 is a ReDoS in Ruby’s URI parser prior to 0.12.2, where invalid URLs containing specific characters trigger significantly longer parsing times via rfc2396_parser.rb and rfc3986_parser.rb. This stems from an incomplete fix related to CVE-2023-28755; 0.10.3 is also listed as a fixed v...

CVE-2023-36617

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396parser.rb and rfc3986parser.rb. NOTE: this issue exists becuse of a...

Ubuntu 23.04 : Ruby vulnerabilities (USN-6181-1)

The remote Ubuntu 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6181-1 advisory. Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications the generate HTTP responses using cgi gem. An attacker coul...

Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities

Summary IBM has addressed multiple vulnerabilities in IBM Spectrum Discover. Webpack loader-utils CVE-2022-37601 is vulnerable to execute arbitrary code on the system caused by a pollution flaw in parseQuery function. OpenStack Keystone CVE-2021-3563 is vulnerable to bypass security restriction...

[SECURITY] [DLA 3447-1] ruby2.5 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3447-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb June 06, 2023 https://wiki.debian.org/LTS -...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service due to [CVE-2022-38900]

Summary Node.js module decode-uri-component is part of the Node.js runtime used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service. This bulletin provides patch information to address the reported...

Fedora 38 : ruby (2023-6b924d3b75)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-6b924d3b75 advisory. Upgrade to Ruby 3.2.2. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CentOS 8 : nodejs:14 (CESA-2023:1743)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:1743 advisory. - The glob-parent package before 6.0.1 for Node.js allows ReDoS regular expression denial of service attacks against the enclosure regular expression...

decode-uri-component: improper input validation resulting in DoS

A flaw was found in decode-uri-component. This issue occurs due to a specially crafted input, resulting in a denial of service...

Security Bulletin: decode-uri-component is vulnerable to CVE-2022-38900 used in IBM Maximo Application Suite

Summary IBM Maximo Application Suite uses decode-uri-component which is vulnerable to CVE-2022-38900. Vulnerability Details CVEID:CVE-2022-38900 DESCRIPTION: decode-uri-component is vulnerable to a denial of service, caused by improper input validation by the decodeComponents function. By sending...

Ruby URI component ReDoS issue

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1...

CVE-2023-28755

Summary: CVE-2023-28755 is a ReDoS vulnerability in Ruby’s URI parsing for the URI component, affecting Ruby versions up to 0.12.0 in the 0.x series and Ruby up to 3.2.1. The issue causes an abnormal increase in parsing time for certain invalid URLs, potentially leading to denial of service. Affe...

CVE-2023-28755

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1...

PT-2023-3595

Name of the Vulnerable Software and Affected Versions Ruby URI component versions prior to 0.12.1 Ruby URI component versions prior to 0.11.1 Ruby URI component versions prior to 0.10.2 Ruby URI component version 0.10.0 Description The issue is related to the incorrect implementation of handling...

CVE-2022-38900

A flaw was found in decode-uri-component. This issue occurs due to a specially crafted input, resulting in a denial of service...

SUSE CVE-2022-38900

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Node.js decode-uri-component

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Node.js decode-uri-component. Vulnerability Details CVEID:CVE-2022-38900 DESCRIPTION: decode-uri-component is vulnerable to a denial of service, caused by improper input validation by the...

GHSA-W573-4HG7-7WGQ decode-uri-component vulnerable to Denial of Service (DoS)

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS...

CVE-2022-38900

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS...

CVE-2022-38900

CVE-2022-38900 is tied to the decode-uri-component package v0.2.0, with an Improper Input Validation defect that can cause a DoS. The connected IBM/Advisory documents in the provided set do not disclose affected products, specific exploit vectors, or a remediation version. No additional technical...