NetSight
IP …
high7.5

CVE-2023-28756

Ruby Time component ReDoS issue

Impact

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

Affected packages

EcosystemPackageAffectedFixed in
rubygemstime>= 0.2.0, < 0.2.20.2.2

Affected products

VendorProductAffected versions
Ruby-LangRuby
through 2.7.7
Ruby-LangTime
Versions 0.1.0, 0.2.1
DebianDebian Linux
Version 10.0
FedoraprojectFedora
Versions 36, 37, 38

Weakness classification

CWE-1333

References