Vulnerability · Published Jun 29, 2023 · Assigned by mitre
CVE-2023-36617
Medium 5.3
In plain English
A medium-severity security flaw in the ruby package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)1.7%top 22.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | ruby | 2.5.9-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | ruby | 3.1.4-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | ruby | 3.1.4-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | ruby-bundled-gems | 3.1.4-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | ruby-bundled-gems | 3.1.4-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | ruby-default-gems | 3.1.4-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | ruby-default-gems | 3.1.4-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | ruby-devel | 2.5.9-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | ruby-devel | 3.1.4-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | ruby-devel | 3.1.4-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | ruby-doc | 3.1.4-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:8 | ruby-doc | 2.5.9-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:9 | ruby-doc | 3.1.4-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | ruby-irb | 2.5.9-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | ruby-libs | 3.1.4-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:8 | ruby-libs | 2.5.9-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:9 | ruby-libs | 3.1.4-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-abrt | 0.4.0-1.module_el8.7.0+3304+9392e77f | ALSA-2024:1431 |
| AlmaLinux:8 | rubygem-abrt | 0.3.0-4.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.3.0-4.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.4.0-1.module_el8.7.0+3304+9392e77f | ALSA-2024:1431 |
| AlmaLinux:8 | rubygem-bigdecimal | 3.1.1-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:8 | rubygem-bigdecimal | 1.3.4-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:9 | rubygem-bigdecimal | 3.1.1-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-bson | 4.3.0-2.module_el8.6.0+3170+4b08f9d4 | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-bson | 4.3.0-2.module_el8.5.0+259+8cec6917 | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-bson | 4.3.0-2.module_el8.5.0+2625+ec418553 | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-bson-doc | 4.3.0-2.module_el8.5.0+2625+ec418553 | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-bundler | 2.3.26-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:8 | rubygem-bundler | 1.16.1-4.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:9 | rubygem-bundler | 2.3.26-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-bundler-doc | 1.16.1-4.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-did_you_mean | 1.2.0-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-io-console | 0.5.11-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:8 | rubygem-io-console | 0.4.6-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:9 | rubygem-io-console | 0.5.11-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-irb | 1.4.1-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | rubygem-irb | 1.4.1-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-json | 2.1.0-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-json | 2.6.1-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | rubygem-json | 2.6.1-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-minitest | 5.15.0-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:8 | rubygem-minitest | 5.10.3-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:9 | rubygem-minitest | 5.15.0-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-mongo | 2.5.1-2.module_el8.5.0+2625+ec418553 | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-mongo-doc | 2.5.1-2.module_el8.5.0+2625+ec418553 | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-mysql2 | 0.5.3-3.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:8 | rubygem-mysql2 | 0.4.10-4.module_el8.5.0+259+8cec6917 | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-mysql2 | 0.4.10-4.module_el8.5.0+2625+ec418553 | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-mysql2 | 0.4.10-4.module_el8.6.0+3170+4b08f9d4 | ALSA-2024:4499 |
| AlmaLinux:9 | rubygem-mysql2 | 0.5.4-1.module_el9.1.0+8+503f6fbd | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-mysql2-doc | 0.4.10-4.module_el8.5.0+2625+ec418553 | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-mysql2-doc | 0.5.3-3.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | rubygem-mysql2-doc | 0.5.4-1.module_el9.1.0+8+503f6fbd | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-net-telnet | 0.1.1-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-openssl | 2.1.2-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-pg | 1.0.0-3.module_el8.9.0+3635+c6f99506 | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-pg | 1.3.2-1.module_el8.7.0+3304+9392e77f | ALSA-2024:1431 |
| AlmaLinux:9 | rubygem-pg | 1.3.5-1.module_el9.1.0+8+503f6fbd | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-pg-doc | 1.3.2-1.module_el8.7.0+3304+9392e77f | ALSA-2024:1431 |
| AlmaLinux:8 | rubygem-pg-doc | 1.0.0-3.module_el8.9.0+3635+c6f99506 | ALSA-2024:4499 |
| AlmaLinux:9 | rubygem-pg-doc | 1.3.5-1.module_el9.1.0+8+503f6fbd | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-power_assert | 2.0.1-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:8 | rubygem-power_assert | 1.1.1-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:9 | rubygem-power_assert | 2.0.1-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-psych | 3.0.2-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-psych | 4.0.4-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | rubygem-psych | 4.0.4-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-rake | 12.3.3-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-rake | 13.0.6-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | rubygem-rake | 13.0.6-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-rbs | 2.7.0-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | rubygem-rbs | 2.7.0-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-rdoc | 6.4.0-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:8 | rubygem-rdoc | 6.0.1.1-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:9 | rubygem-rdoc | 6.4.0-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-rexml | 3.2.5-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | rubygem-rexml | 3.2.5-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-rss | 0.2.9-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | rubygem-rss | 0.2.9-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-test-unit | 3.2.7-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | rubygem-test-unit | 3.5.3-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | rubygem-test-unit | 3.5.3-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-typeprof | 0.21.3-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | rubygem-typeprof | 0.21.3-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygem-xmlrpc | 0.3.0-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | rubygems | 3.3.26-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:8 | rubygems | 2.7.6.3-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:9 | rubygems | 3.3.26-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| AlmaLinux:8 | rubygems-devel | 2.7.6.3-112.module_el8.10.0+3871+342e2c2f | ALSA-2024:4499 |
| AlmaLinux:8 | rubygems-devel | 3.3.26-142.module_el8.9.0+3746+91b8233a | ALSA-2024:1431 |
| AlmaLinux:9 | rubygems-devel | 3.3.26-143.module_el9.3.0+60+5ebc989a | ALSA-2024:1576 |
| Rocky Linux:8 | ruby | 0:2.5.9-112.module+el8.10.0+1839+f1f156ae | RLSA-2024:4499 |
| Rocky Linux:8 | ruby | 0:3.1.4-142.module+el8.9.0+1759+ff68ae72 | RLSA-2024:1431 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.5.0+668+665814fa | RLSA-2024:1431 |
| Rocky Linux:8 | rubygem-abrt | 0:0.3.0-4.module+el8.5.0+738+032c9c02 | RLSA-2024:4499 |
| Rocky Linux:8 | rubygem-bson | 0:4.3.0-2.module+el8.9.0+1536+5f79634e | RLSA-2024:4499 |
| Rocky Linux:8 | rubygem-bundler | 0:1.16.1-4.module+el8.9.0+1536+5f79634e | RLSA-2024:4499 |
| Rocky Linux:8 | rubygem-mongo | 0:2.5.1-2.module+el8.9.0+1536+5f79634e | RLSA-2024:4499 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.4.10-4.module+el8.9.0+1536+5f79634e | RLSA-2024:4499 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.3-3.module+el8.9.0+1759+ff68ae72 | RLSA-2024:1431 |
| Rocky Linux:9 | rubygem-mysql2 | 0:0.5.4-1.module+el9.6.0+31865+0893c253 | RLSA-2024:1576 |
| Rocky Linux:8 | rubygem-pg | 0:1.3.2-1.module+el8.7.0+1081+f0a69743 | RLSA-2024:1431 |
| Rocky Linux:8 | rubygem-pg | 0:1.0.0-3.module+el8.9.0+1536+5f79634e | RLSA-2024:4499 |
| Rocky Linux:9 | rubygem-pg | 0:1.3.5-1.module+el9.6.0+31865+0893c253 | RLSA-2024:1576 |
| RubyGems | uri | 0.11.2 | GHSA-hww2-5g85-429m |
| RubyGems | uri | 0.10.0.3 | GHSA-hww2-5g85-429m |
| RubyGems | uri | 0.10.3 | GHSA-hww2-5g85-429m |
| RubyGems | uri | 0.12.2 | GHSA-hww2-5g85-429m |
| Ubuntu:24.04:LTS | jruby | no fix listed | UBUNTU-CVE-2023-36617 |
| Ubuntu:25.10 | jruby | no fix listed | UBUNTU-CVE-2023-36617 |
| Ubuntu:26.04:LTS | jruby | no fix listed | UBUNTU-CVE-2023-36617 |
| Ubuntu:26.10 | jruby | no fix listed | UBUNTU-CVE-2023-36617 |
| Ubuntu:22.04:LTS | ruby3.0 | 3.0.2-7ubuntu2.4 | UBUNTU-CVE-2023-36617 |
| Ubuntu:22.04:LTS | ruby3.0 | 3.0.2-7ubuntu2.4 | USN-6219-1 |
| Ubuntu:22.04:LTS | rubygems | 3.3.5-2ubuntu1.2 | UBUNTU-CVE-2023-36617 |
| Ubuntu:22.04:LTS | rubygems | 3.3.5-2ubuntu1.2 | USN-7747-1 |
Affected products (as reported)
References
- https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/
- https://security.netapp.com/advisory/ntap-20230725-0002/
- FEDORA-2024-31cac8b8ec vendor-advisory
- FEDORA-2024-48bdd3abbf vendor-advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/