Red Hat Customer Portal

Skip to main content

CVE-2013-4287

Impact:
Moderate
Public Date:
2013-09-09
CWE:
CWE-407->CWE-400
Bugzilla:
1002364: CVE-2013-4287 rubygems: version regex algorithmic complexity vulnerability

The MITRE CVE dictionary describes this issue as:

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Find out more about CVE-2013-4287 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

Red Hat OpenShift Enterprise 1.2 is now in Production 1 Phase of the support
and maintenance life cycle. This has been rated as having Moderate security
impact and is not currently planned to be addressed in future updates. For
additional information, refer to the Red Hat OpenShift Enterprise Life Cycle:
https://access.redhat.com/site/support/policy/updates/openshift.

CVSS v2 metrics

NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.

Base Score 2.6
Base Metrics AV:N/AC:H/Au:N/C:N/I:N/A:P
Access Vector Network
Access Complexity High
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) (ruby193-ruby) RHSA-2013:1427 2013-10-15
RHOSE Client 2.0 (rubygems) RHSA-2014:0207 2014-02-24
MRG Grid for RHEL 6 Server v.2 (rubygems) RHSA-2013:1852 2013-12-17
Red Hat Enterprise Linux 6 (rubygems) RHSA-2013:1441 2013-10-17
MRG Grid Execute Node for RHEL 6 ComputeNode v.2 (rubygems) RHSA-2013:1852 2013-12-17
Red Hat Enterprise Linux OpenStack Platform 3.0 (various) RHSA-2013:1523 2013-11-14

Affected Packages State

Platform Package State
Red Hat OpenShift Enterprise 1 rubygems Will not fix
Red Hat OpenShift Enterprise 2 rubygems Affected
Red Hat Enterprise Linux 7 ruby Not affected
Red Hat Satellite 6 rubygems Affected
Red Hat Satellite 6 ruby193-rubygems Affected
Red Hat OpenShift Enterprise 1 ruby193-rubygems Affected
Red Hat Subscription Asset Manager 1 rubygems Will not fix
Red Hat Subscription Asset Manager 1 ruby193-rubygems Affected
Red Hat OpenShift Enterprise 1 ruby193-ruby Will not fix

Acknowledgements

Red Hat would like to thank Rubygems upstream for reporting this vulnerability. Upstream acknowledges Damir Sharipov as the original reporter.

External References

Last Modified