Vulnerabilities > CVE-2023-22799 - Unspecified vulnerability in Rubyonrails Globalid

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

rubyonrails

NVD

Published: 2023-02-09

Updated: 2023-02-16

Summary

A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.

Vulnerable Configurations

Part	Description	Count
Application	Rubyonrails Rubyonrails Globalid 0.2.1 Rubyonrails Globalid 0.2.2 Rubyonrails Globalid 0.2.3 Rubyonrails Globalid 0.3.0 Rubyonrails Globalid 0.3.1 Rubyonrails Globalid 0.3.2 Rubyonrails Globalid 0.3.3 Rubyonrails Globalid 0.3.4 Rubyonrails Globalid 0.3.5 Rubyonrails Globalid 0.3.6 Rubyonrails Globalid 0.3.7 Rubyonrails Globalid 0.4.0 Rubyonrails Globalid 0.4.1 Rubyonrails Globalid 0.4.2 Rubyonrails Globalid 0.5.0 Rubyonrails Globalid 0.5.1 Rubyonrails Globalid 0.5.2 Rubyonrails Globalid 0.6.0 Rubyonrails Globalid 1.0.0	19

References

https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127