Vulnerability · Published Jan 17, 2023 · Assigned by VulDB

CVE-2022-4891Sisimai string.rb to_plain redos

Low 3.5

In plain English

A low-severity regular-expression denial of service in Sisimai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)1.4%top 27.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic. This vulnerability affects the function to_plain of the file lib/sisimai/string.rb. The manipulation leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. Upgrading to version 4.25.14p12 is able to address this issue. The name of the patch is 51fe2e6521c9c02b421b383943dc9e4bbbe65d4e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218452.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
RubyGems	sisimai	4.25.14p12	GHSA-vm74-j4wq-82xj

Affected products (as reported)

Vendor	Product	Versions
n/a	Sisimai	4.25.14p11

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

https://vuldb.com/?id.218452 vdb-entry, technical-description
https://vuldb.com/?ctiid.218452 signature, permissions-required
https://github.com/sisimai/rb-sisimai/pull/244 issue-tracking
https://gist.githubusercontent.com/gmcabrita/e5dc0332473fc2e3a7a407434c8d21c7/raw/00b12035e5e1b685469f143b94301a50306376ba/example.html exploit
https://github.com/sisimai/rb-sisimai/commit/51fe2e6521c9c02b421b383943dc9e4bbbe65d4e patch
https://github.com/sisimai/rb-sisimai/releases/tag/v4.25.14p12 patch