JezK
Edit File: page-CVE-2013-4287_txt.ri
U:RDoc::TopLevel[ i I"CVE-2013-4287.txt:ETcRDoc::Parser::Simpleo:RDoc::Markup::Document:@parts[S:RDoc::Markup::Heading: leveli: textI"EAlgorithmic complexity vulnerability in RubyGems 2.0.7 and older;To:RDoc::Markup::BlankLine o:RDoc::Markup::Paragraph;[I"QRubyGems validates versions with a regular expression that is vulnerable to ;TI"Ldenial of service due to backtracking. For specially crafted RubyGems ;TI"Lversions attackers can cause denial of service through CPU consumption.;T@ o; ;[I"QRubyGems versions 2.0.7 and older, 2.1.0.rc.1 and 2.1.0.rc.2 are vulnerable.;T@ o; ;[I"SRuby versions 1.9.0 through 2.0.0p247 are vulnerable as they contain embedded ;TI"versions of RubyGems.;T@ o; ;[I"UIt does not appear to be possible to exploit this vulnerability by installing a ;TI"Ogem for RubyGems 1.8.x or 2.0.x. Vulnerable uses of RubyGems API include ;TI"Npackaging a gem (through `gem build`, Gem::Package or Gem::PackageTask), ;TI"Qsending user input to Gem::Version.new, Gem::Version.correct? or use of the ;TI"MGem::Version::VERSION_PATTERN or Gem::Version::ANCHORED_VERSION_PATTERN ;TI"constants.;T@ o; ;[I"NNotably, users of bundler that install gems from git are vulnerable if a ;TI"@malicious author changes the gemspec to an invalid version.;T@ o; ;[I"PThe vulnerability can be fixed by changing the first grouping to an atomic ;TI"Pgrouping in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb. For ;TI"RubyGems 2.0.x:;T@ o:RDoc::Markup::Verbatim;[I"a- VERSION_PATTERN = '[0-9]+(\.[0-9a-zA-Z]+)*(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?' # :nodoc: ;TI"c+ VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?' # :nodoc: ;T:@format0o; ;[I"For RubyGems 1.8.x:;T@ o;;[I">- VERSION_PATTERN = '[0-9]+(\.[0-9a-zA-Z]+)*' # :nodoc: ;TI"@+ VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*' # :nodoc: ;T;0o; ;[I"MThis vulnerability was discovered by Damir Sharipov <dammer2k@gmail.com>;T: @file@:0@omit_headings_from_table_of_contents_below0