Incorrect regular expression in rails-html-sanitizer - CVE-2022-23517

Vulnerability identifier: #VU75786

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23517

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack.

The vulnerability exists due to usage of an incorrect regular expression to parse SVG attributes. A remote attacker can pass a specially crafted SVG image to the application and consume excessive CPU resources.

rails-html-sanitizer
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server 15 SP1 Business Critical Linux
SUSE Linux Enterprise Server 15 SP2 Business Critical Linux
SUSE Linux Enterprise Server 15 SP3 Business Critical Linux
openSUSE Leap
ruby2.1-rubygem-rails-html-sanitizer
ruby2.5-rubygem-rails-html-sanitizer-doc
ruby2.5-rubygem-rails-html-sanitizer-testsuite
ruby2.5-rubygem-rails-html-sanitizer
Red Hat Satellite

Install updates from vendor's website.

rails-html-sanitizer - update to 1.4.4
ruby2.1-rubygem-rails-html-sanitizer - update to 1.0.3-8.14.1
ruby2.5-rubygem-rails-html-sanitizer-doc - update to 1.0.4-150000.4.6.1
ruby2.5-rubygem-rails-html-sanitizer-testsuite - update to 1.0.4-150000.4.6.1
ruby2.5-rubygem-rails-html-sanitizer - update to 1.0.4-150000.4.6.1
Red Hat Satellite - update to 6.13

• https://hackerone.com/reports/1684163
• https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w
• https://github.com/rails/rails-html-sanitizer/commit/56c61c0cebd1e493e8ad7bca2a0191609a4a6979

• Multiple vulnerabilities in rails-html-sanitizer for Ruby
• Multiple vulnerabilities in Red Hat Satellite 6.13
• SUSE update for rubygem-rails-html-sanitizer
• SUSE update for rubygem-rails-html-sanitizer