PT-2017-16930 · Ruby · Ruby+1

Publicado 2017-04-03 · Atualizado 2017-04-11 · CVE-2017-6181

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Onigmo (aka Oniguruma-mod) regular expression library as used in Ruby version 2.4.0

Description The issue allows remote attackers to cause a denial of service, leading to deep recursion and application crash, via a crafted regular expression. This is due to a problem in the parse char class function in regparse.c.

Recommendations For Ruby version 2.4.0, consider updating to a newer version that includes a fix for this issue, as the current version is affected by the denial of service vulnerability.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-6181

Produtos afetados

Onigmo

Ruby

Referências · 6

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6181 · Nota
• http://securityfocus.com/bid/97304 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6181 · Nota de Segurança
• https://bugs.ruby-lang.org/projects/ruby-trunk/repository/revisions/57660 · Aviso do Fabricante
• https://bugs.ruby-lang.org/issues/13234 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-6181 · Aviso do Fabricante