CVE-2023-22796 ReDoS based DoS vulnerability in Active Support's underscore
Attackers can cause denial of service in Ruby on Rails applications by sending specially crafted strings that trigger catastrophic backtracking in regular expressions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-22796?
CVE-2023-22796 is a high-severity denial of service vulnerability in https://github.com/rails/rails, published on 9 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.
Which versions are affected by CVE-2023-22796?
4 open source packages ship an affected version, including activesupport. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
activesupport RubyGems | All versions | 6.1.7.1 |
activesupport RubyGems | All versions | 6.1.7.1 |
activesupport RubyGems | From 7.0.0 | 7.0.4.1 |
activesupport RubyGems | From 7.0.0 | 7.0.4.1 |
Linux distribution packages (8)
rubygem-activesupport-5_1 SUSE:Linux Enterprise High Availability Extension 15 SP1 | All versions | 5.1.4-150000.3.12.1 |
rubygem-activesupport-5_1 SUSE:Linux Enterprise High Availability Extension 15 SP2 | All versions | 5.1.4-150000.3.12.1 |
rubygem-activesupport-5_1 SUSE:Linux Enterprise High Availability Extension 15 SP3 | All versions | 5.1.4-150000.3.12.1 |
rubygem-activesupport-5_1 SUSE:Linux Enterprise High Availability Extension 15 SP4 | All versions | 5.1.4-150000.3.12.1 |
rubygem-activesupport-4_2 SUSE:OpenStack Cloud Crowbar 8 | All versions | 4.2.9-7.15.1 |
rubygem-activesupport-4_2 SUSE:OpenStack Cloud Crowbar 9 | All versions | 4.2.9-7.15.1 |
rubygem-activesupport-5_1 openSUSE:Leap 15.4 | All versions | 5.1.4-150000.3.12.1 |
rubygem-activesupport-7.0 openSUSE:Tumbleweed | All versions | 7.0.4.1-1.1 |
Products include Activesupport Project Activesupport.
How do I fix CVE-2023-22796?
Upgrade activesupport to a fixed version for your release line: 6.1.7.1 or 7.0.4.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-22796 being exploited?
There is no known exploitation of CVE-2023-22796 in the wild and no public exploit code.
Other vulnerabilities in https://github.com/rails/rails
Sources
Also known as DEBIAN-CVE-2023-22796, GHSA-j6gc-792m-qgm2, OESA-2023-1130, OESA-2023-1140, OESA-2023-1145, OESA-2023-1154 and 4 more.