PT-2023-15902 · Sisimai · Sisimai

Gmcabrita · Published 2023-01-17 · Updated 2024-05-17 · CVE-2022-4891

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Sisimai versions up to 4.25.14p11

Description A vulnerability has been found in the function to plain of the file lib/sisimai/string.rb, leading to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used.

Recommendations For Sisimai versions up to 4.25.14p11, upgrade to version 4.25.14p12 to address this issue. As a temporary workaround, consider restricting the use of the to plain function in the lib/sisimai/string.rb file until the patch is applied.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2022-4891

GHSA-VM74-J4WQ-82XJ

Affected Products

Sisimai

References · 12

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sisimai/CVE-2022-4891.yml · Exploit
• 🔥 https://github.com/sisimai/rb-sisimai/pull/244 · Exploit
• 🔥 https://gist.githubusercontent.com/gmcabrita/e5dc0332473fc2e3a7a407434c8d21c7/raw/00b12035e5e1b685469f143b94301a50306376ba/example.html · Exploit
• https://github.com/sisimai/rb-sisimai/commit/51fe2e6521c9c02b421b383943dc9e4bbbe65d4e · Patch
• https://github.com/sisimai/rb-sisimai/releases/tag/v4.25.14p12 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4891 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4891 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vm74-j4wq-82xj · Vendor Advisory
• https://github.com/sisimai/rb-sisimai · Note
• https://vuldb.com/?id.218452 · Note
• https://vuldb.com/?ctiid.218452 · Note
• https://t.me/cibsecurity/56609 · Telegram Post