VDB
Sign up
HIGH7.5

GHSA-fg7x-g82r-94qc

Ruby Time component ReDoS issue

Quick fix

GHSA-fg7x-g82r-94qc — time: upgrade to the fixed version with the command below.

bundle update time

Details

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/time
Introduced in: 0.2.0Fixed in: 0.2.2
Fixbundle update time
RubyGems/time
Introduced in: 0Fixed in: 0.1.1
Fixbundle update time

References