CVE-2013-4287
Fixed in a distro release EPSS 3%
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
Products: redhat enterprise_linux, rubygems, ruby-lang ruby
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rubygems-update | 1.8.23.1 |
| RubyGems | rubygems-update | 1.8.26 |
| RubyGems | rubygems-update | 2.0.8 |
| RubyGems | rubygems-update | 2.1.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rubygems | 3.2.0~rc.1-1 |
| Debian 13 | rubygems | 3.2.0~rc.1-1 |
| Debian 14 | rubygems | 3.2.0~rc.1-1 |
| Red Hat Enterprise Linux 6 | rubygems | 0:1.3.7-4.el6_4 |
| Red Hat enterprise mrg 2 computenode el6 | rubygems | 0:1.8.23.2-1.el6 |
| Red Hat enterprise mrg 2 server el6 | cumin | 0:0.1.5787-4.el6 |
| Red Hat enterprise mrg 2 server el6 | rubygems | 0:1.8.23.2-1.el6 |
| Red Hat openshift 2.0 | rubygems | 0:1.8.24-5.el6op |
| Red Hat openshift 2.0 | rubygems-devel | 0:1.8.24-5.el6op |
| Red Hat openstack 3 | ruby193-ruby | 0:1.9.3.448-40.el6 |
| Red Hat openstack 3 | ruby193-ruby-debuginfo | 0:1.9.3.448-40.el6 |
| Red Hat openstack 3 | ruby193-ruby-devel | 0:1.9.3.448-40.el6 |
| Red Hat openstack 3 | ruby193-ruby-doc | 0:1.9.3.448-40.el6 |
| Red Hat openstack 3 | ruby193-ruby-irb | 0:1.9.3.448-40.el6 |
| Red Hat openstack 3 | ruby193-ruby-libs | 0:1.9.3.448-40.el6 |
| Red Hat openstack 3 | ruby193-ruby-tcltk | 0:1.9.3.448-40.el6 |
| Red Hat openstack 3 | ruby193-rubygem-bigdecimal | 0:1.1.0-40.el6 |
| Red Hat openstack 3 | ruby193-rubygem-io-console | 0:0.3-40.el6 |
| Red Hat openstack 3 | ruby193-rubygem-json | 0:1.5.5-40.el6 |
| Red Hat openstack 3 | ruby193-rubygem-minitest | 0:2.5.1-40.el6 |
| Red Hat openstack 3 | ruby193-rubygem-rake | 0:0.9.2.2-40.el6 |
| Red Hat openstack 3 | ruby193-rubygems | 0:1.8.24-9.el6ost |
| Red Hat openstack 3 | ruby193-rubygems-devel | 0:1.8.24-9.el6ost |
| Red Hat rhel software collections 1 | ruby193-ruby | 0:1.9.3.448-40.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-debuginfo | 0:1.9.3.448-40.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-devel | 0:1.9.3.448-40.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-doc | 0:1.9.3.448-40.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-irb | 0:1.9.3.448-40.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-libs | 0:1.9.3.448-40.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-tcltk | 0:1.9.3.448-40.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-bigdecimal | 0:1.1.0-40.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-io-console | 0:0.3-40.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-json | 0:1.5.5-40.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-minitest | 0:2.5.1-40.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-rake | 0:0.9.2.2-40.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-rdoc | 0:3.9.5-40.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygems | 0:1.8.23-40.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygems-devel | 0:1.8.23-40.el6 |