CVE-2023-36617

CVE Details

Release Date:

2023-06-29

Description

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

See more information about CVE-2023-36617 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	5.3	CVSS Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector:	Network	Attack Complexity:	Low
Privileges Required:	None	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	Low

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (ruby)	ELSA-2024-1431	2024-03-20
Oracle Linux version 8 (ruby)	ELSA-2024-4499	2024-07-15
Oracle Linux version 8 (rubygem-abrt)	ELSA-2024-1431	2024-03-20
Oracle Linux version 8 (rubygem-abrt)	ELSA-2024-4499	2024-07-15
Oracle Linux version 8 (rubygem-bson)	ELSA-2024-4499	2024-07-15
Oracle Linux version 8 (rubygem-bundler)	ELSA-2024-4499	2024-07-15
Oracle Linux version 8 (rubygem-mongo)	ELSA-2024-4499	2024-07-15
Oracle Linux version 8 (rubygem-mysql2)	ELSA-2024-1431	2024-03-20
Oracle Linux version 8 (rubygem-mysql2)	ELSA-2024-4499	2024-07-15
Oracle Linux version 8 (rubygem-pg)	ELSA-2024-1431	2024-03-20
Oracle Linux version 8 (rubygem-pg)	ELSA-2024-4499	2024-07-15
Oracle Linux version 9 (ruby)	ELSA-2024-1576	2024-04-02
Oracle Linux version 9 (rubygem-mysql2)	ELSA-2024-1576	2024-04-02
Oracle Linux version 9 (rubygem-pg)	ELSA-2024-1576	2024-04-02