Description
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rubygems | 3.2.0~rc.1-1 | — |
| Debian 13 | rubygems | 3.2.0~rc.1-1 | — |
| Debian 12 | rubygems | 3.2.0~rc.1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | rubygems | 1.3.7-4.el6_4 | RHSA-2013:1441 |
| RHEL 1 | ruby193-ruby +5 | 1.9.3.448-40.el6 | RHSA-2013:1427 |
| RHEL 1 | ruby193-rubygem-bigdecimal | 1.1.0-40.el6 | RHSA-2013:1427 |
| RHEL 1 | ruby193-rubygem-io-console | 0.3-40.el6 | RHSA-2013:1427 |
| RHEL 1 | ruby193-rubygem-json | 1.5.5-40.el6 | RHSA-2013:1427 |
| RHEL 1 | ruby193-rubygem-minitest | 2.5.1-40.el6 | RHSA-2013:1427 |
| RHEL 1 | ruby193-rubygem-rake | 0.9.2.2-40.el6 | RHSA-2013:1427 |
| RHEL 1 | ruby193-rubygem-rdoc | 3.9.5-40.el6 | RHSA-2013:1427 |
| RHEL 1 | ruby193-rubygems +1 | 1.8.23-40.el6 | RHSA-2013:1427 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 3 | ruby193-ruby +5 | 1.9.3.448-40.el6 | RHSA-2013:1523 |
| Red Hat OpenStack 3 | ruby193-rubygem-bigdecimal | 1.1.0-40.el6 | RHSA-2013:1523 |
| Red Hat OpenStack 3 | ruby193-rubygem-io-console | 0.3-40.el6 | RHSA-2013:1523 |
| Red Hat OpenStack 3 | ruby193-rubygem-json | 1.5.5-40.el6 | RHSA-2013:1523 |
| Red Hat OpenStack 3 | ruby193-rubygem-minitest | 2.5.1-40.el6 | RHSA-2013:1523 |
| Red Hat OpenStack 3 | ruby193-rubygem-rake | 0.9.2.2-40.el6 | RHSA-2013:1523 |
| Red Hat OpenStack 3 | ruby193-rubygems +1 | 1.8.24-9.el6ost | RHSA-2013:1523 |
| Red Hat OpenShift 2 | rubygems +1 | 1.8.24-5.el6op | RHSA-2014:0207 |
| Red Hat MRG 2 | cumin | 0.1.5787-4.el6 | RHSA-2013:1852 |
| Red Hat MRG 2 | rubygems | 1.8.23.2-1.el6 | RHSA-2013:1852 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rubygems-update | < 1.8.23.1 | 1.8.23.1 | GHSA-9j7m-rjqx-48vh |
| RubyGems | rubygems-update | >= 1.8.24, < 1.8.26 | 1.8.26 | GHSA-9j7m-rjqx-48vh |
| RubyGems | rubygems-update | >= 2.0.0, < 2.0.8 | 2.0.8 | GHSA-9j7m-rjqx-48vh |
| RubyGems | rubygems-update | >= 2.1.0.rc.1, < 2.1.0 | 2.1.0 | GHSA-9j7m-rjqx-48vh |
Advisories 5
- RHSA-2014:0207 Red Hat Security Advisory: rubygems security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1852 Red Hat Security Advisory: Red Hat Enterprise MRG Grid 2.4 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1523 Red Hat Security Advisory: ruby193-ruby security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1441 Red Hat Security Advisory: rubygems security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1427 Red Hat Security Advisory: ruby193-ruby security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- [oss-security] 20130909 CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older mailing-list
- 55381 third-party-advisory
- RHSA-2013:1523 vendor-advisory
- http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html
- https://puppet.com/security/cve/cve-2013-4287
- RHSA-2013:1427 vendor-advisory
- RHSA-2013:1852 vendor-advisory
- RHSA-2013:1441 vendor-advisory
- RHSA-2014:0207 vendor-advisory