Summary
USN-6055-1 fixed a vulnerability in Ruby. Unfortunately it introduced a regression.
This update reverts the patches applied to CVE-2023-28755 in order to fix the regression
pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Ruby incorrectly handled certain regular expressions.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2023-28755)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | ruby2.5 | 2.5.1-1ubuntu1.15 |
| Ubuntu · 20.04 LTS 20.04:LTS | ruby2.7 | 2.7.0-5ubuntu1.10 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ruby2.3 | 2.3.1-2~ubuntu16.04.16+esm6 |
Vulnerabilities 1
-
Medium 5.3
Ruby URI component ReDoS issue
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.…