Skip to content
OpenAdvisories
Medium USN-6219-1 2 CVEs

ruby2.3, ruby2.5, ruby2.7, ruby3.0, ruby3.1 vulnerabilities

Published Jul 12, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Ruby incorrectly handled certain regular expressions.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 20.10 and Ubuntu 20.04 LTS.
(CVE-2023-28755)

It was discovered that Ruby incorrectly handled certain regular expressions.
An attacker could possibly use this issue to cause a denial of service.
This issue exists because of an incomplete fix for CVE-2023-28755.
(CVE-2023-36617)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS ruby2.7 2.7.0-5ubuntu1.12
Ubuntu · 22.04 LTS 22.04:LTS ruby3.0 3.0.2-7ubuntu2.4
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ruby2.3 2.3.1-2~ubuntu16.04.16+esm8
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ruby2.5 2.5.1-1ubuntu1.16+esm1

Vulnerabilities 2

  • Medium 5.3
    CVE-2023-28755

    Ruby URI component ReDoS issue

    A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine Wolfi RubyGems
  • Medium 5.3
    CVE-2023-36617

    URI gem has ReDoS vulnerability

    A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser…

    kube-fluentd-operator ruby2.3 ruby2.5 jruby Debian Ubuntu Azure Linux Wolfi RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2023-28755
  • report
    https://ubuntu.com/security/CVE-2023-36617