CVE-2008-3443 Denial of service in n/a

What is CVE-2008-3443?

CVE-2008-3443 is a medium-severity denial of service vulnerability in Ruby-Lang Ruby, published on 14 Aug 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick.

Weakness: CWE-399

Which versions are affected by CVE-2008-3443?

It affects 1 product.

Products include Ruby-Lang Ruby.

How do I fix CVE-2008-3443?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2008-3443 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-3443 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Ruby-Lang Ruby

• CVE-2009-4124 Memory corruption in n/a Critical 10.0
• CVE-2022-28738 Use after free in n/a Critical 9.8
• CVE-2011-4121 Weak cryptography in OpenSSL extension of Ruby (Git trunk) Critical 9.8
• CVE-2017-17790 Command injection in n/a Critical 9.8
• CVE-2017-11465 Memory corruption in n/a Critical 9.8

All Ruby-Lang Ruby vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DSA-1695-1, GHSA-v838-v88j-gw93.