CVE catalog

CVE-2022-23837

ruby-sidekiq: CVE-2022-23837

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
5.21% · Oct 25, 2026

In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-sidekiqsid8.1.7+dfsg-1fixed
Debianruby-sidekiqforky8.1.7+dfsg-1fixed
Debianruby-sidekiqtrixie7.3.2+dfsg-1fixed
Debianruby-sidekiqbookworm6.4.1+dfsg-1fixed
Ubunturuby-sidekiq16.043.3.4~dfsg-1vulnerable
Ubunturuby-sidekiq16.044.0.1+dfsg-2vulnerable
Ubunturuby-sidekiqpro6.0.4+dfsg-2vulnerable
Ubunturuby-sidekiqpro6.3.1+dfsg-1vulnerable
Ubunturuby-sidekiqpro6.3.1+dfsg-1ubuntu0.1~esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-sidekiqsourcesid6.4.1+dfsg-1not yet assignedNot reported[1004193]
Debianruby-sidekiqsourceforky6.4.1+dfsg-1not yet assignedNot reported[1004193]
Debianruby-sidekiqsourcetrixie6.4.1+dfsg-1not yet assignedNot reported[1004193]
Debianruby-sidekiqsourcebookworm6.4.1+dfsg-1not yet assignedNot reported[1004193]
Ubunturuby-sidekiqdebpro6.3.1+dfsg-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2022-23837Not reported

[Debian bug #1004193]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ruby-sidekiq]Fixed
    Details (2)

    • 6.4.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 6.4.1+dfsg-1

      dsa · ruby-sidekiq · debian · bookworm

    • 6.4.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 6.4.1+dfsg-1

      dsa · ruby-sidekiq · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]