CVE-2023-22795 ReDoS based DoS vulnerability in Action Dispatch

Q: Which versions are affected by CVE-2023-22795?

4 open source packages ship an affected version, including actionpack. It affects 2 products.

Q: Is CVE-2023-22795 being exploited?

There is no known exploitation of CVE-2023-22795 in the wild and no public exploit code.

Q: How do I fix CVE-2023-22795?

Upgrade actionpack to a fixed version for your release line: 6.1.7.1 or 7.0.4.1.

High 7.5 Published 9 Feb 2023 Updated 2 Aug 2024

Attackers can cause denial of service in Ruby on Rails applications via crafted HTTP headers triggering regex backtracking.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-22795?

CVE-2023-22795 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 9 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

Weakness: CWE-1333, CWE-400

Which versions are affected by CVE-2023-22795?

4 open source packages ship an affected version, including actionpack. It affects 2 products.

Package	Affected	Fixed in
`actionpack` RubyGems	From `4.0.0.beta1`	`6.1.7.1`
`actionpack` RubyGems	From `4.0.0.beta1`	`6.1.7.1`
`actionpack` RubyGems	From `7.0.0`	`7.0.4.1`
`actionpack` RubyGems	From `7.0.0`	`7.0.4.1`

Products include Debian Debian Linux, Rubyonrails Rails.

How do I fix CVE-2023-22795?

Upgrade actionpack to a fixed version for your release line: 6.1.7.1 or 7.0.4.1.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-22795 being exploited?

There is no known exploitation of CVE-2023-22795 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-13562, DEBIAN-CVE-2023-22795, GHSA-8xww-x3g3-6jcv, UBUNTU-CVE-2023-22795.