Blog
24 Sep 2013
CVE-2013-4363 Algorithmic complexity vulnerability in RubyGems 2.1.4 and older
by Eric Hodel
The patch for CVE-2013-4363 was insufficiently verified so the combined regular expression for verifying gem version remains vulnerable following CVE-2013-4363.
RubyGems validates versions with a regular expression that is vulnerable to denial of service due to backtracking. For specially crafted RubyGems versions attackers can cause denial of service through CPU consumption.
RubyGems versions 2.1.4 and older are vulnerable.
RubyGems versions 2.1.5, 2.0.10, 1.8.27 and 1.8.23.2 contain fixes.
Ruby versions 1.9.0 through 2.0.0p247 are vulnerable as they contain embedded versions of RubyGems.
It does not appear to be possible to exploit this vulnerability by installing a
gem for RubyGems 1.8.x or newer. Vulnerable uses of RubyGems API include
packaging a gem (through gem build, Gem::Package or Gem::PackageTask),
sending user input to Gem::Version.new, Gem::Version.correct? or use of the
Gem::Version::VERSION_PATTERN or Gem::Version::ANCHORED_VERSION_PATTERN
constants.
Notably, users of bundler that install gems from git are vulnerable if a malicious author changes the gemspec to an invalid version.
The vulnerability can be fixed through one of the following patches to remove infinite repetition in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb:
Patch for RubyGems 2.1.x
Patch for RubyGems 2.0.x
Patch for RubyGems 1.8.x
Patch for RubyGems 1.8.23.1
This vulnerability was discovered by Alexander Cherepanov cherepan@mccme.ru