CVE-2023-22795

Name
CVE-2023-22795
Description
A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://discuss.rubyonrails.org/t/cve-2023-22795-possible-redos-based-dos-vulnerability-in-action-dispatch/82118
Third Party Advisory https://www.debian.org/security/2023/dsa-5372
support@hackerone.com https://security.netapp.com/advisory/ntap-20240202-0010/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* rails >= 7.0.0 < 7.0.4.1
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* rails >= 6.1.0 < 6.1.7.1
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* ruby >= None < 3.2.0
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* rails >= None < 6.1.7.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
ruby edge-main 3.1.4-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
ruby edge-main 3.1.3-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
ruby edge-main 3.1.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
ruby edge-main 3.0.3-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
ruby edge-main 2.7.4-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ruby edge-main 2.7.4-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ruby edge-main 2.7.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ruby edge-main 2.7.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
ruby edge-main 2.7.2-r0 None possibly vulnerable
ruby edge-main 2.6.6-r0 None possibly vulnerable
ruby edge-main 2.6.5-r0 None possibly vulnerable
ruby edge-main 2.5.2-r0 None possibly vulnerable
ruby edge-main 2.5.1-r0 None possibly vulnerable
ruby edge-main 2.4.3-r0 None possibly vulnerable
ruby edge-main 2.4.2-r0 None possibly vulnerable
ruby 3.22-main 3.1.4-r0 None possibly vulnerable
ruby 3.22-main 3.1.3-r0 None possibly vulnerable
ruby 3.22-main 3.1.2-r0 None possibly vulnerable
ruby 3.22-main 3.0.3-r0 None possibly vulnerable
ruby 3.22-main 2.7.4-r0 None possibly vulnerable
ruby 3.22-main 2.7.3-r0 None possibly vulnerable
ruby 3.22-main 2.7.2-r0 None possibly vulnerable
ruby 3.22-main 2.6.6-r0 None possibly vulnerable
ruby 3.22-main 2.6.5-r0 None possibly vulnerable
ruby 3.22-main 2.5.2-r0 None possibly vulnerable
ruby 3.22-main 2.5.1-r0 None possibly vulnerable
ruby 3.22-main 2.4.3-r0 None possibly vulnerable
ruby 3.22-main 2.4.2-r0 None possibly vulnerable
ruby 3.21-main 3.1.4-r0 None possibly vulnerable
ruby 3.21-main 3.1.3-r0 None possibly vulnerable
ruby 3.21-main 3.1.2-r0 None possibly vulnerable
ruby 3.21-main 3.0.3-r0 None possibly vulnerable
ruby 3.21-main 2.7.4-r0 None possibly vulnerable
ruby 3.21-main 2.7.3-r0 None possibly vulnerable
ruby 3.21-main 2.7.2-r0 None possibly vulnerable
ruby 3.21-main 2.6.6-r0 None possibly vulnerable
ruby 3.21-main 2.6.5-r0 None possibly vulnerable
ruby 3.21-main 2.5.2-r0 None possibly vulnerable
ruby 3.21-main 2.5.1-r0 None possibly vulnerable
ruby 3.21-main 2.4.3-r0 None possibly vulnerable
ruby 3.21-main 2.4.2-r0 None possibly vulnerable
ruby 3.20-main 3.1.4-r0 None possibly vulnerable
ruby 3.20-main 3.1.3-r0 None possibly vulnerable
ruby 3.20-main 3.1.2-r0 None possibly vulnerable
ruby 3.20-main 3.0.3-r0 None possibly vulnerable
ruby 3.20-main 2.7.4-r0 None possibly vulnerable
ruby 3.20-main 2.7.3-r0 None possibly vulnerable
ruby 3.20-main 2.7.2-r0 None possibly vulnerable
ruby 3.20-main 2.6.6-r0 None possibly vulnerable
ruby 3.20-main 2.6.5-r0 None possibly vulnerable
ruby 3.20-main 2.5.2-r0 None possibly vulnerable
ruby 3.20-main 2.5.1-r0 None possibly vulnerable
ruby 3.20-main 2.4.3-r0 None possibly vulnerable
ruby 3.20-main 2.4.2-r0 None possibly vulnerable
ruby 3.19-main 3.1.4-r0 None possibly vulnerable
ruby 3.19-main 3.1.3-r0 None possibly vulnerable
ruby 3.19-main 3.1.2-r0 None possibly vulnerable
ruby 3.19-main 3.0.3-r0 None possibly vulnerable
ruby 3.19-main 2.7.4-r0 None possibly vulnerable
ruby 3.19-main 2.7.3-r0 None possibly vulnerable
ruby 3.19-main 2.7.2-r0 None possibly vulnerable
ruby 3.19-main 2.6.6-r0 None possibly vulnerable
ruby 3.19-main 2.6.5-r0 None possibly vulnerable
ruby 3.19-main 2.5.2-r0 None possibly vulnerable
ruby 3.19-main 2.5.1-r0 None possibly vulnerable
ruby 3.19-main 2.4.3-r0 None possibly vulnerable
ruby 3.19-main 2.4.2-r0 None possibly vulnerable
ruby 3.17-main 3.1.5-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
ruby 3.17-main 3.1.4-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
ruby 3.17-main 3.1.3-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable