PT-2013-4974 · Ruby+1 · Rubygems+1

Kurt Seifried · Published 2013-10-09 · Updated 2025-09-29 · CVE-2013-4363

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions RubyGems versions 1.8.24 through 1.8.26 RubyGems versions prior to 1.8.23.2 RubyGems versions 2.0.x prior to 2.0.10 RubyGems versions 2.1.x prior to 2.1.5

Description The issue is related to an algorithmic complexity vulnerability in Gem::Version::ANCHORED VERSION PATTERN in lib/rubygems/version.rb. This vulnerability allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Recommendations For RubyGems versions 1.8.24 through 1.8.26, update to a version outside of this range to resolve the issue. For RubyGems versions prior to 1.8.23.2, update to version 1.8.23.2 or later to resolve the issue. For RubyGems versions 2.0.x prior to 2.0.10, update to version 2.0.10 or later to resolve the issue. For RubyGems versions 2.1.x prior to 2.1.5, update to version 2.1.5 or later to resolve the issue.

Exploit

Fix

DoS

Weakness Enumeration

CWE-310

Related Identifiers

ALSA-2025_16880

ALT-PU-2016-2061

CVE-2013-4363

GHSA-9QVM-2VHF-Q649

MGASA-2013-0297

Affected Products

Alt Linux

Rubygems

References · 19

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2013-4363.yml · Exploit
• https://osv.dev/vulnerability/MGASA-2013-0297 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9qvm-2vhf-q649 · Vendor Advisory
• http://openwall.com/lists/oss-security/2013/09/14/3 · Patch
• http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2013/09/18/8 · Patch
• http://openwall.com/lists/oss-security/2013/09/20/1 · Patch
• https://osv.dev/vulnerability/CVE-2013-4363 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4363 · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2013-September/115886.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0297.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-4363 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4363 · Vendor Advisory
• https://github.com/rubygems/rubygems · Note
• https://puppet.com/security/cve/cve-2013-4363 · Note