Vulnerability Database
296,869
Total vulnerabilities in the database
CVE-2013-4287
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
| Software | From | Fixed in |
|---|---|---|
| redhat / enterprise_linux | 6.0 | 6.0.x |
| rubygems / rubygems | 1.8.24 | 1.8.24.x |
| rubygems / rubygems | 1.8.16 | 1.8.16.x |
| rubygems / rubygems | 2.1.0-rc2 | 2.1.0-rc2.x |
| rubygems / rubygems | 2.0.6 | 2.0.6.x |
| rubygems / rubygems | 1.8.20 | 1.8.20.x |
| rubygems / rubygems | 1.8.0 | 1.8.0.x |
| rubygems / rubygems | 2.0.5 | 2.0.5.x |
| rubygems / rubygems | 2.0.4 | 2.0.4.x |
| rubygems / rubygems | 1.8.8 | 1.8.8.x |
| rubygems / rubygems | 1.8.12 | 1.8.12.x |
| rubygems / rubygems | 1.8.22 | 1.8.22.x |
| rubygems / rubygems | 1.8.17 | 1.8.17.x |
| rubygems / rubygems | 1.8.15 | 1.8.15.x |
| rubygems / rubygems | 1.8.5 | 1.8.5.x |
| rubygems / rubygems | 1.8.21 | 1.8.21.x |
| rubygems / rubygems | 1.8.2 | 1.8.2.x |
| rubygems / rubygems | 1.8.9 | 1.8.9.x |
| rubygems / rubygems | 2.0.3 | 2.0.3.x |
| rubygems / rubygems | 1.8.6 | 1.8.6.x |
| rubygems / rubygems | 1.8.14 | 1.8.14.x |
| rubygems / rubygems | 1.8.10 | 1.8.10.x |
| rubygems / rubygems | 2.0.0 | 2.0.0.x |
| rubygems / rubygems | 1.8.19 | 1.8.19.x |
| rubygems / rubygems | 1.8.13 | 1.8.13.x |
| rubygems / rubygems | 1.8.3 | 1.8.3.x |
| rubygems / rubygems | 1.8.18 | 1.8.18.x |
| rubygems / rubygems | 1.8.25 | 1.8.25.x |
| rubygems / rubygems | 2.0.2 | 2.0.2.x |
| rubygems / rubygems | - | 1.8.23.x |
| rubygems / rubygems | 1.8.7 | 1.8.7.x |
| rubygems / rubygems | 1.8.1 | 1.8.1.x |
| rubygems / rubygems | 2.0.7 | 2.0.7.x |
| rubygems / rubygems | 2.0.1 | 2.0.1.x |
| rubygems / rubygems | 2.1.0-rc1 | 2.1.0-rc1.x |
| rubygems / rubygems | 1.8.4 | 1.8.4.x |
| rubygems / rubygems | 1.8.11 | 1.8.11.x |
| ruby-lang / ruby | 1.9.3-p426 | 1.9.3-p426.x |
| ruby-lang / ruby | 2.0.0 | 2.0.0.x |
| ruby-lang / ruby | 1.9.3-p286 | 1.9.3-p286.x |
| ruby-lang / ruby | 1.9.3-p385 | 1.9.3-p385.x |
| ruby-lang / ruby | 1.9.3-p383 | 1.9.3-p383.x |
| ruby-lang / ruby | 2.0.0-p195 | 2.0.0-p195.x |
| ruby-lang / ruby | 1.9.3-p429 | 1.9.3-p429.x |
| ruby-lang / ruby | 2.0 | 2.0.x |
| ruby-lang / ruby | 2.0.0-preview1 | 2.0.0-preview1.x |
| ruby-lang / ruby | 1.9.2 | 1.9.2.x |
| ruby-lang / ruby | 1.9.1 | 1.9.1.x |
| ruby-lang / ruby | 2.0.0-p247 | 2.0.0-p247.x |
| ruby-lang / ruby | 2.0.0-p0 | 2.0.0-p0.x |
| ruby-lang / ruby | 1.9.3-p125 | 1.9.3-p125.x |
| ruby-lang / ruby | 2.0.0-rc1 | 2.0.0-rc1.x |
| ruby-lang / ruby | 2.0.0-preview2 | 2.0.0-preview2.x |
| ruby-lang / ruby | 1.9.3-p194 | 1.9.3-p194.x |
| ruby-lang / ruby | 1.9.3 | 1.9.3.x |
| ruby-lang / ruby | 1.9 | 1.9.x |
| ruby-lang / ruby | 1.9.3-p392 | 1.9.3-p392.x |
| ruby-lang / ruby | 2.0.0-rc2 | 2.0.0-rc2.x |
| ruby-lang / ruby | 1.9.3-p0 | 1.9.3-p0.x |
rubygems-update
|
- | 1.8.23.1 |
|
rubygems-update
|
1.8.24 | 1.8.26 |
|
rubygems-update
|
2.0.0 | 2.0.8 |
|
rubygems-update
|
2.1.0.rc.1 | 2.1.0 |
- http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html
- http://rhn.redhat.com/errata/RHSA-2013-1427.html
- http://rhn.redhat.com/errata/RHSA-2013-1441.html
- http://rhn.redhat.com/errata/RHSA-2013-1523.html
- http://rhn.redhat.com/errata/RHSA-2013-1852.html
- http://rhn.redhat.com/errata/RHSA-2014-0207.html
- http://secunia.com/advisories/55381
- http://www.openwall.com/lists/oss-security/2013/09/10/1
- https://github.com/rubygems/rubygems/blob/03a074e8838683f45611b119fd8f363aa44fe2fd/CHANGELOG.md
- https://github.com/rubygems/rubygems/commit/938a7e31ac73655845ab9045629ff3f580a125da
- https://github.com/rubygems/rubygems/commit/b697536f2455e8c8853cf5cf8a1017a36031ed67
- https://github.com/rubygems/rubygems/commit/b9baec03145aed684d1cd3c87dcac3cc06becd9b
- https://github.com/rubygems/rubygems/commit/ed733bc379d75620f5be4213f89d1d7b38be3191
- https://puppet.com/security/cve/cve-2013-4287
- https://web.archive.org/web/20160806152839/https://puppet.com/security/cve/cve-2013-4287/
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime