NetSight
IP …
high7.5

CVE-2021-41817

Regular expression denial of service vulnerability (ReDoS) in date

Impact

Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected. The fix limits the input length up to 128 bytes by default instead of changing the regexps. This is because Date gem uses many Regexps and it is possible that there are still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the limitation by explicitly passing limit keywords as nil like Date.parse(str, limit: nil), but note that it may take a long time to parse. Please update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later. You can use gem update date to update it. If you are using bundler, please add gem "date", ">= 3.2.1" to your Gemfile. If you import `date` from the standard library rather than as a gem you should update your Ruby install to `3.0.3`, `2.7.5`, `2.6.9` or later. Users unable to upgrade may consider using `Date.strptime` instead with a predefined date format ```ruby Date.strptime('2001-02-20', '%Y-%m-%d') ```

Affected packages

EcosystemPackageAffectedFixed in
rubygemsdate>= 3.2.0, < 3.2.13.2.1

Affected products

VendorProductAffected versions
Ruby-LangDate
before 2.0.1
from 3.0.0 before 3.0.2
from 3.1.0 before 3.1.2
Version 3.2.0
Ruby-LangRuby
from 2.6.0 before 2.6.9
from 2.7.0 before 2.7.5
from 3.0.0 before 3.0.3
RedhatSoftware Collections
All versions
RedhatEnterprise Linux
Versions 7.0, 8.0
FedoraprojectFedora
Versions 34, 35
DebianDebian Linux
Versions 9.0, 10.0, 11.0
SuseLinux Enterprise
Versions 12.0, 15.0
OpensuseFactory
All versions
OpensuseLeap
Version 15.2

Weakness classification

CWE-1333

References