CVE-2013-4363 RubyGems Regular Expression Denial of Service

What is CVE-2013-4363?

CVE-2013-4363 is a medium-severity denial of service vulnerability in Ruby-Lang Ruby, published on 17 Oct 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.

Weakness: CWE-310

Which versions are affected by CVE-2013-4363?

8 open source packages ship an affected version, including rubygems-update. It affects 2 products.

Products include Ruby-Lang Ruby, Rubygems Rubygems.

How do I fix CVE-2013-4363?

Upgrade rubygems-update to a fixed version for your release line: 1.8.23.2, 1.8.27, 2.0.10 or 2.1.5.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2013-4363 being exploited?

There is no known exploitation of CVE-2013-4363 in the wild and no public exploit code.

Other vulnerabilities in Ruby-Lang Ruby

• CVE-2009-4124 Memory corruption in n/a Critical 10.0
• CVE-2022-28738 Use after free in n/a Critical 9.8
• CVE-2011-4121 Weak cryptography in OpenSSL extension of Ruby (Git trunk) Critical 9.8
• CVE-2017-17790 Command injection in n/a Critical 9.8
• CVE-2017-11465 Memory corruption in n/a Critical 9.8

All Ruby-Lang Ruby vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-4363, GHSA-9qvm-2vhf-q649.