CVE catalog
CVE-2023-36617
rubygems: CVE-2023-36617
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.70% · Oct 25, 2026
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | jruby | sid | 10.1.2.0+ds-1 | not affected |
| Debian | jruby | forky | 10.1.2.0+ds-1 | not affected |
| Debian | jruby | trixie | 9.4.8.0+ds-3 | not affected |
| Debian | jruby | bookworm | 9.3.9.0+ds-8 | not affected |
| Debian | ruby3.1 | bookworm | 3.1.2-7+deb12u1 | not affected |
| Debian | ruby3.1 | bookworm-security | 3.1.2-7+deb12u1 | not affected |
| Debian | rubygems | sid | 4.0.22-1 | not affected |
| Debian | rubygems | forky | 4.0.22-1 | not affected |
| Debian | rubygems | trixie | 3.6.7-2 | not affected |
| Debian | rubygems | bookworm | 3.3.15-2+deb12u1 | not affected |
| Ubuntu | rubygems | 22.04 | 3.2.5-2 | vulnerable |
| Ubuntu | rubygems | 22.04 | 3.2.27-2 | vulnerable |
| Ubuntu | rubygems | 22.04 | 3.2.27-3 | vulnerable |
| Ubuntu | rubygems | 22.04 | 3.3.5-2 | vulnerable |
| Ubuntu | rubygems | 22.04 | 3.3.5-2ubuntu1.1 | vulnerable |
| Ubuntu | rubygems | 22.04 | 3.3.5-2ubuntu1.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | jruby | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | jruby | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | jruby | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | jruby | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Debian | ruby3.1 | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Debian | rubygems | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | rubygems | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | rubygems | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | rubygems | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Ubuntu | rubygems | deb | 22.04 | 3.3.5-2ubuntu1.2 | Not reported | USN-7747-1 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://cert-portal.siemens.com/productcert/csaf/ssa-806742.json]
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2024_1431.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2023-36617]
- [https://osv.dev/vulnerability/USN-7747-1]
- [https://security-tracker.debian.org/tracker/CVE-2023-36617]
- [https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-36617.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1590.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]