CVE-2020-7663
published 2020-06-02CVE-2020-7663: websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when…
PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
4.40%
90.4th percentile
websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | ruby-websocket-extensions | < ruby-websocket-extensions 0.1.5-1 (bookworm) | ruby-websocket-extensions 0.1.5-1 (bookworm) |
| websocket-extensions_project | websocket-extensions | < 0.1.5 | 0.1.5 |
| websocket-extensions_project | websocket-extensions | >= 0 < 0.1.5 | 0.1.5 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
websocket-extensions vulnerability
vendor_ubuntu·2020-09-16·CVSS 7.5
CVE-2020-7663 [HIGH] websocket-extensions vulnerability
Title: websocket-extensions vulnerability
Summary: websocket-extensions could be made to exhaust the server's capacity to
process incoming requests if it received specially crafted requests.
It was discovered that websocket-extensions does not properly parse
special headers. A remote attacker could use this issue to cause regex
backtracking, resulting in a denial of service. (CVE-2020-7663)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser
vendor_redhat·2020-06-02·CVSS 7.5
CVE-2020-7663 [HIGH] CWE-20 rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser
rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser
websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
A flaw was found in the websocket-extensions ruby module in versions prior to 0.1.5. The parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte s
Debian
CVE-2020-7663: ruby-websocket-extensions - websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) v...
vendor_debian·2020·CVSS 7.5
CVE-2020-7663 [HIGH] CVE-2020-7663: ruby-websocket-extensions - websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) v...
websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
Scope: local
bookworm: resolved (fixed in 0.1.5-1)
bullseye: resolved (fixed in 0.1.5-1)
forky: resolved (fixed in 0.1.5-1)
sid: resolved (fixed in 0.1.5-1)
trixie: resolved (fixed in 0.1.5-1)
OSV
ruby-websocket-extensions vulnerability
osv·2020-09-16·CVSS 7.5
CVE-2020-7663 [HIGH] ruby-websocket-extensions vulnerability
ruby-websocket-extensions vulnerability
It was discovered that websocket-extensions does not properly parse
special headers. A remote attacker could use this issue to cause regex
backtracking, resulting in a denial of service. (CVE-2020-7663)
GHSA
Regular Expression Denial of Service in websocket-extensions (RubyGem)
ghsa·2020-06-05
CVE-2020-7663 [HIGH] CWE-400 Regular Expression Denial of Service in websocket-extensions (RubyGem)
Regular Expression Denial of Service in websocket-extensions (RubyGem)
### Impact
The ReDoS flaw allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request containing a header of the following form:
Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...
That is, a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. The parser takes exponential time to reject this header as invalid, and this will block the processing of any other work on the same thread. Thus if you are running a single-threaded server, such a request can render your service completely unavailable.
### Patches
Users should upgrade to version 0.1.5.
### Workarounds
OSV
Regular Expression Denial of Service in websocket-extensions (RubyGem)
osv·2020-06-05
CVE-2020-7663 [HIGH] Regular Expression Denial of Service in websocket-extensions (RubyGem)
Regular Expression Denial of Service in websocket-extensions (RubyGem)
### Impact
The ReDoS flaw allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request containing a header of the following form:
Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...
That is, a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. The parser takes exponential time to reject this header as invalid, and this will block the processing of any other work on the same thread. Thus if you are running a single-threaded server, such a request can render your service completely unavailable.
### Patches
Users should upgrade to version 0.1.5.
### Workarounds
OSV
CVE-2020-7663: websocket-extensions ruby module prior to 0
osv·2020-06-02·CVSS 7.5
CVE-2020-7663 [HIGH] CVE-2020-7663: websocket-extensions ruby module prior to 0
websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-7663 rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser [fedora-all]
bugzilla·2020-06-10·CVSS 7.5
CVE-2020-7663 [HIGH] CVE-2020-7663 rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser [fedora-all]
CVE-2020-7663 rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue a
Bugzilla
CVE-2020-7663 rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser
bugzilla·2020-06-10·CVSS 7.5
CVE-2020-7663 [HIGH] CVE-2020-7663 rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser
CVE-2020-7663 rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser
websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
Reference:
https://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2
Upstream commit:
https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a81318924188
https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensionshttps://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838bhttps://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2https://lists.debian.org/debian-lts-announce/2020/08/msg00031.htmlhttps://snyk.io/vuln/SNYK-RUBY-WEBSOCKETEXTENSIONS-570830https://usn.ubuntu.com/4502-1/https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensionshttps://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838bhttps://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2https://lists.debian.org/debian-lts-announce/2020/08/msg00031.htmlhttps://snyk.io/vuln/SNYK-RUBY-WEBSOCKETEXTENSIONS-570830https://usn.ubuntu.com/4502-1/
2020-06-02
Published