Logo
›
›vulnerability›CVE-2023-28756
Name
CVE-2023-28756
Source
NVD ( link)Debian ( link)
Description
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
CWEs
CWE-1333
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/ruby/time/releases/Release Notes
https://lists.debian.org/debian-lts-announce/2023/04/msg00033.htmlMailing List
https://security.netapp.com/advisory/ntap-20230526-0004/Third Party Advisory
https://www.ruby-lang.org/en/downloads/releases/Release Notes
https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/Release Notes
https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/Vendor Advisory
https://github.com/ruby/time/releases/Release Notes
https://lists.debian.org/debian-lts-announce/2023/04/msg00033.htmlMailing List
https://security.netapp.com/advisory/ntap-20230526-0004/Third Party Advisory
https://www.ruby-lang.org/en/downloads/releases/Release Notes
https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/Release Notes
https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/Vendor Advisory

Analysis#

Affected Component
Analysis
ruby
Patched

Vulnerability Ratings#

5.3
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
ruby
buildroot
2025.02.x
3.4.9
Not Affected
ruby
buildroot
master
4.0.3
Not Affected
ruby
openwrt
master
4.0.2-r1
Not Affected
ruby
openwrt
openwrt-25.12
3.4.9-r1
Not Affected
ruby
yocto
master
4.0.5
Not Affected
ruby
yocto
scarthgap
3.3.10
Not Affected

Resolved with patches#

ruby (yocto:kirkstone)

#
Title
Author
Resolve
1
CVE-2023-28756
Hiroshi SHIBATA <hsbt@ruby-lang.org>
CVE-2023-28756