Regular Expression Denial Of Service (ReDoS)

🗓️ 04 Apr 2023 14:02:44Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 23 Views

uri ReDoS vulnerability in rfc3986_parser.r

Reporter	Title	Published	Views	Family All 273
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.4 fixes multiple security vulnerabilities	15 Dec 202314:31	–	ibm
FreeBSD	rubygem-uri -- ReDoS vulnerability	28 Mar 202300:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2023-158)	20 Apr 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2025-839)	5 Feb 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2 : ruby (ALASRUBY3.0-2023-001)	27 Sep 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0080: ruby:2.7 (ALINUX3-SA-2023:0080)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : ruby:2.7 (ALSA-2023:3821)	29 Jun 202300:00	–	nessus
Tenable Nessus	AlmaLinux 8 : ruby:3.1 (ALSA-2024:1431)	21 Mar 202400:00	–	nessus
Tenable Nessus	AlmaLinux 9 : ruby:3.1 (ALSA-2024:1576)	3 Apr 202400:00	–	nessus
Tenable Nessus	AlmaLinux 8 : ruby:3.0 (ALSA-2024:3500)	31 May 202400:00	–	nessus

Vulners

Node

ruby rubyMatch3.1.2-r1ruby

AND

ruby rubyMatch3.1.3-r0ruby

AND

alpinelinux alpine_linuxMatch3.17

OR

ruby rubyMatch3.1.2-r0ruby

AND

ruby rubyMatch3.1.3-r0ruby

AND

alpinelinux alpine_linuxMatch3.16

OR

ruby rubyMatch2.7.6-r0ruby

AND

ruby rubyMatch2.7.7-r0ruby

AND

ruby rubyMatch2.7.5-r0ruby

AND

ruby rubyMatch2.7.3-r1ruby

AND

ruby rubyMatch2.7.4-r0ruby

AND

alpinelinux alpine_linuxMatch3.14

OR

ruby rubyMatch3.0.2-r0ruby

AND

ruby rubyMatch3.0.5-r0ruby

AND

ruby rubyMatch3.0.4-r0ruby

AND

ruby rubyMatch3.0.3-r0ruby

AND

alpinelinux alpine_linuxMatch3.15

OR

ruby rubyMatch3.1.2-r1ruby

AND

ruby rubyMatch2.7.4-r1ruby

AND

ruby rubyMatch2.6.5-r2ruby

AND

ruby rubyMatch2.7.1-r3ruby

AND

ruby rubyMatch2.7.3-r1ruby

AND

ruby rubyMatch3.1.3-r0ruby

AND

ruby rubyMatch2.7.4-r0ruby

AND

ruby rubyMatch3.1.1-r0ruby

AND

ruby rubyMatch3.0.3-r0ruby

AND

ruby rubyMatch2.7.2-r3ruby

AND

ruby rubyMatch3.0.2-r0ruby

AND

ruby rubyMatch2.6.6-r4ruby

AND

ruby rubyMatch2.7.2-r4ruby

AND

ruby rubyMatch3.1.2-r0ruby

AND

ruby rubyMatch2.6.6-r2ruby

AND

ruby rubyMatch2.7.3-r0ruby

AND

alpinelinux alpine_linuxMatchedge

OR

ruby2.5 ruby2.5Match2.5.5-3+deb10u3debian

AND

ruby2.5 ruby2.5Match2.5.5-3+deb10u2debian

AND

debian debian_linuxMatch10

OR

jruby jrubyMatch9.1.17.0-3debian

AND

debian debian_linuxMatch999

OR

ruby2.7 ruby2.7Match2.7.2-3debian

AND

debian debian_linuxMatch11

OR

ruby-lang uriMatch0.12.0ruby

OR

ruby-lang uriMatch0.11.0ruby

OR

ruby-lang uriMatch0.10.1ruby

OR

ruby-lang uriMatch0.10.0ruby

Source	Link
github	www.github.com/ruby/uri/commit/17861a53e499a2eabf7ba83d63914d0f01921d70
github	www.github.com/ruby/uri/commit/d8b9a843d04b2410f21a59e68c50d5553eedccf6
github	www.github.com/ruby/uri/commit/28371d13eff9014edfe109e4a8f86e985dc514ce
github	www.github.com/ruby/uri/commit/eaf89cc31619d49e67c64d0b58ea9dc38892d175
lists	www.lists.debian.org/debian-lts-announce/2023/04/msg00033.html
secdb	www.secdb.alpinelinux.org/v3.14/main.yaml
secdb	www.secdb.alpinelinux.org/v3.16/main.yaml
secdb	www.secdb.alpinelinux.org/v3.15/main.yaml
secdb	www.secdb.alpinelinux.org/v3.17/main.yaml
secdb	www.secdb.alpinelinux.org/edge/main.yaml

14 Feb 2025 21:31Current

7.3High risk

Vulners AI Score7.3

CVSS 3.15.3

EPSS0.00337

SSVC

regular expression denial of service vulnerability insecure regex pattern uri application crash crafted patterns security issue