Vulnerability · Published May 29, 2024 · Assigned by GitHub_M

CVE-2024-35221Denial of service when publishing a package on rubygems.org

Medium 4.3

In plain English

A medium-severity uncontrolled resource consumption in rubygems.org from rubygems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 57.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab.

Affected products (as reported)

Vendor	Product	Versions
rubygems	rubygems.org	< 2024-04-12

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4vc5-whwr-7hh2 x_refsource_CONFIRM
https://en.wikipedia.org/wiki/Billion_laughs_attack x_refsource_MISC
https://github.com/ruby/ruby/blob/7cf74a2ff28b1b4c26e367d0d67521f7e1fed239/lib/rubygems/safe_yaml.rb#L28 x_refsource_MISC