PT-2013-4974 · Ruby+1 · Rubygems+1

Kurt Seifried · Publicado 2013-10-09 · Atualizado 2025-09-29 · CVE-2013-4363

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions RubyGems versions 1.8.24 through 1.8.26 RubyGems versions prior to 1.8.23.2 RubyGems versions 2.0.x prior to 2.0.10 RubyGems versions 2.1.x prior to 2.1.5

Description The issue is related to an algorithmic complexity vulnerability in Gem::Version::ANCHORED VERSION PATTERN in lib/rubygems/version.rb. This vulnerability allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Recommendations For RubyGems versions 1.8.24 through 1.8.26, update to a version outside of this range to resolve the issue. For RubyGems versions prior to 1.8.23.2, update to version 1.8.23.2 or later to resolve the issue. For RubyGems versions 2.0.x prior to 2.0.10, update to version 2.0.10 or later to resolve the issue. For RubyGems versions 2.1.x prior to 2.1.5, update to version 2.1.5 or later to resolve the issue.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

ALSA-2025_16880

ALT-PU-2016-2061

CVE-2013-4363

GHSA-9QVM-2VHF-Q649

MGASA-2013-0297

Produtos afetados

Alt Linux

Rubygems

Referências · 19

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2013-4363.yml · Exploit
• https://github.com/rubygems/rubygems · Nota
• https://osv.dev/vulnerability/MGASA-2013-0297 · Aviso do Fabricante
• https://puppet.com/security/cve/cve-2013-4363 · Nota
• https://osv.dev/vulnerability/GHSA-9qvm-2vhf-q649 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=11276 · Nota
• http://openwall.com/lists/oss-security/2013/09/14/3 · Correção
• http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/09/18/8 · Correção
• http://openwall.com/lists/oss-security/2013/09/20/1 · Correção
• https://osv.dev/vulnerability/CVE-2013-4363 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-4363 · Nota de Segurança
• https://lists.fedoraproject.org/pipermail/package-announce/2013-September/115886.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4287 · Nota
• https://advisories.mageia.org/MGASA-2013-0297.html · Nota de Segurança