PT-2017-16930 · Ruby · Ruby+1

Published 2017-04-03 · Updated 2017-04-11 · CVE-2017-6181

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Onigmo (aka Oniguruma-mod) regular expression library as used in Ruby version 2.4.0

Description The issue allows remote attackers to cause a denial of service, leading to deep recursion and application crash, via a crafted regular expression. This is due to a problem in the parse char class function in regparse.c.

Recommendations For Ruby version 2.4.0, consider updating to a newer version that includes a fix for this issue, as the current version is affected by the denial of service vulnerability.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-6181

Affected Products

Onigmo

Ruby

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-6181 · Security Note
• https://bugs.ruby-lang.org/projects/ruby-trunk/repository/revisions/57660 · Vendor Advisory
• https://bugs.ruby-lang.org/issues/13234 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6181 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6181 · Note
• http://securityfocus.com/bid/97304 · Note