CVE-2020-7663 Regular Expression Denial of Service in websocket-extensions (RubyGem)
An attacker can cause a Denial of Service in Ruby applications using the websocket-extensions library by sending a malicious Sec-WebSocket-Extensions header.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7663?
CVE-2020-7663 is a high-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 2 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
Which versions are affected by CVE-2020-7663?
2 open source packages ship an affected version, including websocket-extensions. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
websocket-extensions RubyGems | All versions | 0.1.5 |
websocket-extensions RubyGems | All versions | 0.1.5 |
Linux distribution packages (9)
rubygem-websocket-extensions SUSE:Linux Enterprise High Availability Extension 15 SP1 | All versions | 0.1.3-150000.3.4.1 |
rubygem-websocket-extensions SUSE:Linux Enterprise High Availability Extension 15 SP2 | All versions | 0.1.3-150000.3.4.1 |
rubygem-websocket-extensions SUSE:Linux Enterprise High Availability Extension 15 SP3 | All versions | 0.1.3-150000.3.4.1 |
rubygem-websocket-extensions SUSE:Linux Enterprise High Availability Extension 15 SP4 | All versions | 0.1.3-150000.3.4.1 |
rubygem-websocket-extensions openSUSE:Leap 15.4 | All versions | 0.1.3-150000.3.4.1 |
ruby3.2-rubygem-websocket-extensions openSUSE:Tumbleweed | All versions | 0.1.5-1.16 |
rubygem-websocket-extensions openSUSE:Tumbleweed | All versions | 0.1.5-1.20 |
rubygem-websocket-extensions openSUSE:Tumbleweed | All versions | 0.1.5-1.22 |
rubygem-websocket-extensions openSUSE:Tumbleweed | All versions | 0.1.5-1.24 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Websocket-Extensions Project Websocket-Extensions.
How do I fix CVE-2020-7663?
Upgrade websocket-extensions to 0.1.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-7663 being exploited?
There is no known exploitation of CVE-2020-7663 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2020-7663, DLA-2334-1, GHSA-g6wq-qcwm-j5g2, OESA-2022-1553, OESA-2022-2093, SNYK-RUBY-WEBSOCKETEXTENSIONS-570830 and 8 more.