Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.
Summary
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | rubygems-update (RubyGems) | before 1.8.23.2 | 1.8.23.2 | Patch available | GHSA-9qvm-2vhf-q649 |
| — | rubygems-update (RubyGems) | 1.8.24 to before 1.8.27 | 1.8.27 | Patch available | GHSA-9qvm-2vhf-q649 |
| — | rubygems-update (RubyGems) | 2.0.0 to before 2.0.10 | 2.0.10 | Patch available | GHSA-9qvm-2vhf-q649 |
| — | rubygems-update (RubyGems) | 2.1.0 to before 2.1.5 | 2.1.5 | Patch available | GHSA-9qvm-2vhf-q649 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- rubygems-update (RubyGems) Vendor— Affected before 1.8.23.2 Fixed in 1.8.23.2 Patch available GHSA-9qvm-2vhf-q649
- rubygems-update (RubyGems) Vendor— Affected 1.8.24 to before 1.8.27 Fixed in 1.8.27 Patch available GHSA-9qvm-2vhf-q649
- rubygems-update (RubyGems) Vendor— Affected 2.0.0 to before 2.0.10 Fixed in 2.0.10 Patch available GHSA-9qvm-2vhf-q649
- rubygems-update (RubyGems) Vendor— Affected 2.1.0 to before 2.1.5 Fixed in 2.1.5 Patch available GHSA-9qvm-2vhf-q649
CPE configurations NVD · 71
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:* | up to 1.8.23 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.0:*:*:*:*:*:*:* | 1.8.0 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.1:*:*:*:*:*:*:* | 1.8.1 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.2:*:*:*:*:*:*:* | 1.8.2 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.3:*:*:*:*:*:*:* | 1.8.3 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.4:*:*:*:*:*:*:* | 1.8.4 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.5:*:*:*:*:*:*:* | 1.8.5 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.6:*:*:*:*:*:*:* | 1.8.6 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.7:*:*:*:*:*:*:* | 1.8.7 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.8:*:*:*:*:*:*:* | 1.8.8 | Vulnerable | rubygems |
- cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:* Versions up to 1.8.23 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.4:*:*:*:*:*:*:* Versions 1.8.4 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.5:*:*:*:*:*:*:* Versions 1.8.5 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.6:*:*:*:*:*:*:* Versions 1.8.6 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.7:*:*:*:*:*:*:* Versions 1.8.7 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.8:*:*:*:*:*:*:* Versions 1.8.8 Vulnerable ·rubygems
Show 61 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rubygems:rubygems:1.8.9:*:*:*:*:*:*:* | 1.8.9 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.10:*:*:*:*:*:*:* | 1.8.10 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.11:*:*:*:*:*:*:* | 1.8.11 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.12:*:*:*:*:*:*:* | 1.8.12 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.13:*:*:*:*:*:*:* | 1.8.13 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.14:*:*:*:*:*:*:* | 1.8.14 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.15:*:*:*:*:*:*:* | 1.8.15 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.16:*:*:*:*:*:*:* | 1.8.16 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.17:*:*:*:*:*:*:* | 1.8.17 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.18:*:*:*:*:*:*:* | 1.8.18 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.19:*:*:*:*:*:*:* | 1.8.19 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.20:*:*:*:*:*:*:* | 1.8.20 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.21:*:*:*:*:*:*:* | 1.8.21 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.22:*:*:*:*:*:*:* | 1.8.22 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.24:*:*:*:*:*:*:* | 1.8.24 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.25:*:*:*:*:*:*:* | 1.8.25 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.26:*:*:*:*:*:*:* | 1.8.26 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:* | 2.0.0 preview2 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:* | 2.0.0 preview2.1 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:* | 2.0.0 preview2.2 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:* | 2.0.0 rc1 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:* | 2.0.0 rc2 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:* | 2.0.1 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:* | 2.0.2 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:* | 2.0.3 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:* | 2.0.4 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:* | 2.0.5 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:* | 2.0.6 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:* | 2.0.7 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:* | 2.0.8 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:* | 2.0.9 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.1.0:*:*:*:*:*:*:* | 2.1.0 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.1.0:rc1:*:*:*:*:*:* | 2.1.0 rc1 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.1.0:rc2:*:*:*:*:*:* | 2.1.0 rc2 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.1.1:*:*:*:*:*:*:* | 2.1.1 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.1.2:*:*:*:*:*:*:* | 2.1.2 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.1.3:*:*:*:*:*:*:* | 2.1.3 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:2.1.4:*:*:*:*:*:*:* | 2.1.4 | Vulnerable | rubygems |
| cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:* | 1.9 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:* | 1.9.1 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:* | 1.9.2 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:* | 1.9.3 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:* | 1.9.3 p0 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:* | 1.9.3 p125 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:* | 1.9.3 p194 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:* | 1.9.3 p286 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:* | 1.9.3 p383 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p385:*:*:*:*:*:* | 1.9.3 p385 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p392:*:*:*:*:*:* | 1.9.3 p392 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p426:*:*:*:*:*:* | 1.9.3 p426 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p429:*:*:*:*:*:* | 1.9.3 p429 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:* | 2.0.0 p0 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:* | 2.0.0 p195 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:* | 2.0.0 p247 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:preview1:*:*:*:*:*:* | 2.0.0 preview1 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:preview2:*:*:*:*:*:* | 2.0.0 preview2 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:* | 2.0.0 rc1 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:* | 2.0.0 rc2 | Vulnerable | ruby |
- cpe:2.3:a:rubygems:rubygems:1.8.9:*:*:*:*:*:*:* Versions 1.8.9 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.10:*:*:*:*:*:*:* Versions 1.8.10 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.11:*:*:*:*:*:*:* Versions 1.8.11 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.12:*:*:*:*:*:*:* Versions 1.8.12 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.13:*:*:*:*:*:*:* Versions 1.8.13 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.14:*:*:*:*:*:*:* Versions 1.8.14 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.15:*:*:*:*:*:*:* Versions 1.8.15 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.16:*:*:*:*:*:*:* Versions 1.8.16 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.17:*:*:*:*:*:*:* Versions 1.8.17 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.18:*:*:*:*:*:*:* Versions 1.8.18 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.19:*:*:*:*:*:*:* Versions 1.8.19 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.20:*:*:*:*:*:*:* Versions 1.8.20 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.21:*:*:*:*:*:*:* Versions 1.8.21 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.22:*:*:*:*:*:*:* Versions 1.8.22 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.24:*:*:*:*:*:*:* Versions 1.8.24 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.25:*:*:*:*:*:*:* Versions 1.8.25 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.26:*:*:*:*:*:*:* Versions 1.8.26 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:* Versions 2.0.0 preview2 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:* Versions 2.0.0 preview2.1 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:* Versions 2.0.0 preview2.2 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:* Versions 2.0.6 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:* Versions 2.0.7 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:* Versions 2.0.8 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:* Versions 2.0.9 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.1.0:rc1:*:*:*:*:*:* Versions 2.1.0 rc1 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.1.0:rc2:*:*:*:*:*:* Versions 2.1.0 rc2 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·rubygems
- cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:* Versions 1.9.3 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:* Versions 1.9.3 p0 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:* Versions 1.9.3 p125 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:* Versions 1.9.3 p194 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:* Versions 1.9.3 p286 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:* Versions 1.9.3 p383 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p385:*:*:*:*:*:* Versions 1.9.3 p385 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p392:*:*:*:*:*:* Versions 1.9.3 p392 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p426:*:*:*:*:*:* Versions 1.9.3 p426 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p429:*:*:*:*:*:* Versions 1.9.3 p429 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:* Versions 2.0.0 p0 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:* Versions 2.0.0 p195 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:* Versions 2.0.0 p247 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:preview1:*:*:*:*:*:* Versions 2.0.0 preview1 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:preview2:*:*:*:*:*:* Versions 2.0.0 preview2 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·ruby
Remediation
- Fix · GHSA-9qvm-2vhf-q649 rubygems-update (RubyGems) Fixed in 1.8.23.2 Advisory →
- Fix · GHSA-9qvm-2vhf-q649 rubygems-update (RubyGems) Fixed in 1.8.27 Advisory →
- Fix · GHSA-9qvm-2vhf-q649 rubygems-update (RubyGems) Fixed in 2.0.10 Advisory →
- Fix · GHSA-9qvm-2vhf-q649 rubygems-update (RubyGems) Fixed in 2.1.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 9 products
- CloudForms Management Engine 5
- OpenShift Enterprise 1
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise MRG 2
- Red Hat OpenStack Platform 3
- Red Hat Satellite 6
- Red Hat Software Collections
- Red Hat Subscription Asset Manager
Timeline
- 2026-10-02 Threatist record created from CVE-2013-4363
- 2026-10-03 Alias added: GHSA-9qvm-2vhf-q649
References
Patch 4
- [oss-security] 20130918 Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older
- http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html
- [oss-security] 20130915 Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older
- [oss-security] 20130920 Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older
Sources
- CVE-2013-4363 · CVE Program
- CVE-2013-4363 · NVD
- FIRST EPSS
- GHSA-9qvm-2vhf-q649 · GitHub Advisory Database · CC BY 4.0
- CVE-2013-4363 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences