CVE-2023-31606

RubyGems/RedCloth CVE-2023-31606: high 7.5, EPSS 1.51%

RedCloth Regular Expression Denial of Service issue

Action: Upgrade RedCloth to 4.3.3 or later.

bundle update RedCloth

Affected

Fixed versions

Sources

• osv: GHSA-qcm3-vfq5-wfr2
• https://nvd.nist.gov/vuln/detail/CVE-2023-31606
• https://github.com/jgarber/redcloth/issues/73
• https://github.com/jgarber/redcloth/commit/8b1327688fef8e6617792054ef299d7bc74c0a1e
• https://github.com/e23e/CVE-2023-31606#readme
• https://github.com/jgarber/redcloth
• https://github.com/jgarber/redcloth/blob/v4.3.2/lib/redcloth/formatters/html.rb#L327
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/RedCloth/CVE-2023-31606.yml
• https://lists.debian.org/debian-lts-announce/2023/07/msg00002.html
• https://security.gentoo.org/glsa/202401-14

CVE-2023-31606 · published 2023-06-06T18:30:20Z · modified 2024-02-16T08:20:39.647392Z · JSON