Skip to content
OpenAdvisories
High USN-6055-1 2 CVEs

ruby2.3, ruby2.5, ruby2.7 vulnerabilities

Published May 4, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Ruby incorrectly handled certain regular expressions.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2023-28755)

It was discovered that Ruby incorrectly handled certain regular expressions.
An attacker could possibly use this issue to cause a denial of service.
This issue is being addressed only for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2023-28756)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS ruby2.5 2.5.1-1ubuntu1.14
Ubuntu · 20.04 LTS 20.04:LTS ruby2.7 2.7.0-5ubuntu1.9
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ruby2.3 2.3.1-2~ubuntu16.04.16+esm5

Vulnerabilities 2

  • High 7.5
    CVE-2023-28756

    Ruby Time component ReDoS issue

    A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are …

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine Wolfi RubyGems
  • Medium 5.3
    CVE-2023-28755

    Ruby URI component ReDoS issue

    A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine Wolfi RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2023-28755
  • report
    https://ubuntu.com/security/CVE-2023-28756