PT-2020-21438 · Uap · Uap-Ruby

Published 2020-03-10 · Updated 2020-03-10

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions uap-ruby versions prior to 2.6.0

Description The issue concerns regular expression denial of service (REDoS) due to overlapping capture groups in some regexes. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

Recommendations For versions prior to 2.6.0, update uap-ruby to version 2.6.0 or later.

Related Identifiers

GHSA-PCQQ-5962-HVCW

Affected Products

Uap-Ruby

References · 4

• https://osv.dev/vulnerability/GHSA-pcqq-5962-hvcw · Vendor Advisory
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/user_agent_parser/GHSA-pcqq-5962-hvcw.yml · Note
• https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw · Note
• https://github.com/ua-parser/uap-ruby/commit/2bb18268f4c5ba7d4ba0e21c296bf6437063da3a · Note