Upstream information
Description
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
National Vulnerability Database | |
---|---|
Base Score | 4.3 |
Vector | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Access Vector | Network |
Access Complexity | Medium |
Authentication | None |
Confidentiality Impact | None |
Integrity Impact | None |
Availability Impact | Partial |
SUSE Security Advisories:
- SUSE-SU-2013:1659-1, published Tue Nov 12 11:04:12 MST 2013 openSUSE-SU-2013:1611-1
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
SUSE Studio Onsite 1.3 |
| Patchnames: slestso13-ruby19 |
SUSE Timeline for this CVE
CVE page created: Wed Sep 11 11:15:05 2013CVE page last modified: Thu Dec 7 13:06:31 2023