A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.
CVE-2023-22799 - High Severity Vulnerability
URIs for your models makes it easy to pass references around.
Library home page: https://rubygems.org/gems/globalid-0.4.2.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /var/lib/gems/2.3.0/cache/globalid-0.4.2.gem
Dependency Hierarchy: - rails-6.0.1.gem (Root Library) - actiontext-6.0.1.gem - activestorage-6.0.1.gem - activejob-6.0.1.gem - :x: **globalid-0.4.2.gem** (Vulnerable Library)
Found in HEAD commit: b66d50027439b3e466dc08eb2b308fa9b38abddc
Found in base branch: master
A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.
Publish Date: 2023-02-09
URL: CVE-2023-22799
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-23c2-gwp5-pxw9
Release Date: 2023-02-09
Fix Resolution: globalid - 1.0.1
Step up your Open Source Security Game with Mend here