Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
| Link | Tags |
|---|---|
| https://puppet.com/security/cve/cve-2013-4363 | |
| http://www.openwall.com/lists/oss-security/2013/09/18/8 | mailing list patch |
| http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html | patch vendor advisory |
| http://www.openwall.com/lists/oss-security/2013/09/14/3 | mailing list patch |
| http://www.openwall.com/lists/oss-security/2013/09/20/1 | mailing list patch |