Incorrect Regular Expression in URI - CVE-2023-36617

Vulnerability identifier: #VU77803

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-36617

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when parsing URL. A remote attacker can pass specially crafted URL to the application and perform regular expression denial of service (ReDos) attack.

Note, the vulnerability exists due to incomplete fix for #VU74004 (CVE-2023-28755).

URI
Oracle Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Ubuntu
openEuler
Fedora
ruby2.3 (Ubuntu package)
libruby2.3 (Ubuntu package)
ruby2.5 (Ubuntu package)
libruby2.5 (Ubuntu package)
rubygem-net-telnet
rubygem-rss
rubygem-abrt
rubygem-abrt-doc
rubygem-xmlrpc
rubygem-io-console
rubygem-mysql2-doc
rubygem-mysql2
rubygem-typeprof
rubygem-pg-doc
rubygem-pg
rubygem-power_assert
rubygem-did_you_mean
rubygem-bigdecimal
rubygem-irb
rubygem-bundler
rubygem-bundler-doc
rubygem-json
rubygem-openssl
rubygems (Ubuntu package)
rubygem-mongo-doc
rubygem-mongo
ruby-devel
ruby-help
ruby-debuginfo
ruby-irb
ruby
ruby-debugsource
ruby-libs
ruby-doc
ruby2.7 (Ubuntu package)
libruby2.7 (Ubuntu package)
rubygem-rbs
rubygems
rubygems-devel
rubygem-psych
ruby3.1 (Ubuntu package)
libruby3.1 (Ubuntu package)
ruby-bundled-gems
ruby-default-gems
rubygem-rexml
rubygem-test-unit
rubygem-bson
rubygem-bson-doc
rubygem-minitest
rubygem-rdoc
rubygem-rake
Netcool Operations Insight
Isolation Segment
VMware Tanzu Application Service for VMs
Cloud Pak for Network Automation
OpenManage Network Integration (OMNI)
ruby3.0 (Ubuntu package)
libruby3.0 (Ubuntu package)

Install updates from vendor's website.

URI - addressed in versions 0.10.3, 0.12.2
ruby2.3 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
libruby2.3 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
ruby2.5 (Ubuntu package) - update to Ubuntu Pro
libruby2.5 (Ubuntu package) - update to Ubuntu Pro
rubygem-net-telnet - update to 0.1.1-112.0.1
rubygem-net-telnet - update to 0.1.1-120
rubygem-rss - update to 0.2.9-9
rubygem-abrt - update to 0.3.0-4
rubygem-abrt-doc - update to 0.3.0-4
rubygem-xmlrpc - update to 0.3.0-112.0.1
rubygem-xmlrpc - update to 0.3.0-120
rubygem-io-console - addressed in versions 0.4.6-112.0.1, 0.5.11-9
rubygem-io-console - update to 0.4.6-120
rubygem-mysql2-doc - update to 0.4.10-4
rubygem-mysql2 - update to 0.4.10-4
rubygem-typeprof - update to 0.21.3-9
rubygem-pg-doc - update to 1.0.0-3.0.1
rubygem-pg - update to 1.0.0-3.0.1
rubygem-power_assert - addressed in versions 1.1.1-112.0.1, 2.0.1-9
rubygem-power_assert - update to 1.1.1-120
rubygem-did_you_mean - update to 1.2.0-112.0.1
rubygem-did_you_mean - update to 1.2.0-120
rubygem-bigdecimal - addressed in versions 1.3.4-112.0.1, 3.1.1-9
rubygem-bigdecimal - update to 1.3.4-120
rubygem-irb - update to 1.4.1-9
Netcool Operations Insight - update to 1.6.11
rubygem-bundler - addressed in versions 1.16.1-4, 2.3.26-9
rubygem-bundler-doc - update to 1.16.1-4
rubygem-json - addressed in versions 2.1.0-112.0.1, 2.6.1-9
rubygem-json - update to 2.1.0-120
rubygem-openssl - update to 2.1.2-112.0.1
rubygem-openssl - update to 2.1.2-120
rubygems (Ubuntu package) - update to 2.3.5-2ubuntu1.2
rubygem-mongo-doc - update to 2.5.1-2
rubygem-mongo - update to 2.5.1-2
ruby-devel - update to 2.5.8-120
ruby-help - update to 2.5.8-120
ruby-debuginfo - update to 2.5.8-120
ruby-irb - update to 2.5.8-120
ruby - update to 2.5.8-120
ruby-debugsource - update to 2.5.8-120
ruby-libs - addressed in versions 2.5.9-112.0.1, 3.1.4-9
ruby - addressed in versions 2.5.9-112.0.1, 3.1.4-9
ruby-devel - addressed in versions 2.5.9-112.0.1, 3.1.4-9
ruby-doc - addressed in versions 2.5.9-112.0.1, 3.1.4-9
ruby-irb - update to 2.5.9-112.0.1
Cloud Pak for Network Automation - update to 2.6.5
ruby2.7 (Ubuntu package) - update to 2.7.0-5ubuntu1.12
libruby2.7 (Ubuntu package) - update to 2.7.0-5ubuntu1.12
rubygem-rbs - update to 2.7.0-9
rubygems - addressed in versions 2.7.6.3-112.0.1, 3.3.26-9
rubygems-devel - addressed in versions 2.7.6.3-112.0.1, 3.3.26-9
rubygems - update to 2.7.6-120
rubygems-devel - update to 2.7.6-120
Isolation Segment - addressed in versions 2.11.38, 2.13.23, 3.0.16, 4.0.8
VMware Tanzu Application Service for VMs - addressed in versions 2.11.44, 2.13.26, 3.0.16, 4.0.8
ruby3.0 (Ubuntu package) - addressed in versions 3.0.2-7ubuntu2.4, 3.0.4-7ubuntu0.2
libruby3.0 (Ubuntu package) - addressed in versions 3.0.2-7ubuntu2.4, 3.0.4-7ubuntu0.2
rubygem-psych - addressed in versions 3.0.2-112.0.1, 4.0.4-9
rubygem-psych - update to 3.0.2-120
ruby3.1 (Ubuntu package) - update to 3.1.2-6ubuntu0.23.04.2
libruby3.1 (Ubuntu package) - update to 3.1.2-6ubuntu0.23.04.2
ruby-bundled-gems - update to 3.1.4-9
ruby-default-gems - update to 3.1.4-9
ruby - addressed in versions 3.2.4-182.fc38, 3.2.4-182.fc39
rubygem-rexml - update to 3.2.5-9
rubygem-test-unit - addressed in versions 3.2.7-112.0.1, 3.5.3-9
rubygem-test-unit - update to 3.2.7-120
OpenManage Network Integration (OMNI) - update to 3.7
rubygem-bson - update to 4.3.0-2
rubygem-bson-doc - update to 4.3.0-2
rubygem-minitest - addressed in versions 5.10.3-112.0.1, 5.15.0-9
rubygem-minitest - update to 5.10.3-120
rubygem-rdoc - addressed in versions 6.0.1.1-112.0.1, 6.4.0-9
rubygem-rdoc - update to 6.0.1.1-120
rubygem-rake - update to 12.3.0-120
rubygem-rake - addressed in versions 12.3.3-112.0.1, 13.0.6-9

• https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/

• Denial of service in URI gem for Ruby
• Ubuntu update for ruby2.3
• VMware Tanzu products update for Ruby
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• openEuler update for ruby
• Red Hat Enterprise Linux 8 update for the ruby:3.1 module
• Red Hat Enterprise Linux 9 update for the ruby:3.1 module
• Multiple vulnerabilities in Oracle Linux
• Fedora 39 update for ruby
• Fedora 38 update for ruby
• Red Hat Enterprise Linux 8 update for ruby module
• Multiple vulnerabilities in Dell OpenManage Network Integration (OMNI)
• Anolis OS update for ruby
• Anolis OS update for ruby:2.5 module
• Ubuntu update for rubygems