CVE-2021-41817

CWE-1333CWE-400 — Uncontrolled Resource Consumption11 documents9 sources
Severity
7.5HIGH
EPSS
0.5%
top 34.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Ruby-lang DateRuby-lang RubyDebian Debian Linux+4 more
Timeline
PublishedJan 1
Latest updateJan 18

Description

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages8 packages

▶NVDruby-lang/date3.0.0 — 3.0.2+3
▶RubyGemsdate3.2.0 — 3.2.1+3
▶NVDruby-lang/ruby2.6.0 — 2.6.9+2
▶Debianruby2.7< 2.7.4-1+deb11u1
▶Ubunturuby2.5< 2.5.1-1ubuntu1.11

Also affects: Debian Linux 10.0, 11.0, 9.0, Fedora 34, 35, Linux Enterprise 12.0, 15.0, Enterprise Linux 7.0, 8.0

🔴Vulnerability Details

5
OSV
ruby2.3, ruby2.5, ruby2.7 vulnerabilities↗2022-01-18
▶
OSV
CVE-2021-41817: Date↗2022-01-01
▶
CVEList
CVE-2021-41817: Date↗2022-01-01
▶
OSV
Regular expression denial of service vulnerability (ReDoS) in date↗2021-11-16
▶
GHSA
Regular expression denial of service vulnerability (ReDoS) in date↗2021-11-16
▶

📋Vendor Advisories

4
Ubuntu
Ruby vulnerabilities↗2022-01-18
▶
Microsoft
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1 3.1.2 3.0.2 and 2.0.1.↗2022-01-11
▶
Red Hat
ruby: Regular expression denial of service vulnerability of Date parsing methods↗2021-11-15
▶
Debian
CVE-2021-41817: ruby2.7 - Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expressi...↗2021
▶

💬Community

1
HackerOne
Ruby - Regular Expression Denial of Service Vulnerability of Date Parsing Methods↗2021-11-19
▶