oss-sec mailing list archives
Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older
From: Eric Hodel <drbrain () segment7 net>
Date: Fri, 20 Sep 2013 00:13:58 -0700
On Sep 18, 2013, at 18:03, Eric Hodel <drbrain () segment7 net> wrote:
On Sep 18, 2013, at 15:05, Alexander Cherepanov <cherepan () mccme ru> wrote:...but if you really want to suppress backtracking (say, for optimization) it is easy: either atomic grouping for every repetition (exactly the way you have already done but for other repetitions also) or add extra "+" after each "+" and "*". That's according to http://www.ruby-doc.org/core-2.0.0/Regexp.html .Thank you. I glossed over the * in ANCHORED_VERSION_PATTERN, and this fixes the problem with minimal change (something I would prefer for a security fix). Here is a complete updated patch including the backtracking and extra "-" fixes: <CVE-2013-XXXX.2.patch> The same script as my previous message can be used to verify it.
Ok, I have a complete set of patches and vulnerability announcement. Can I get a CVE? = Algorithmic complexity vulnerability in RubyGems 2.1.4 and older The patch for CVE-2013-4287 was insufficiently verified so the combined regular expression for verifying gem version remains vulnerable following CVE-2013-4287. RubyGems validates versions with a regular expression that is vulnerable to denial of service due to backtracking. For specially crafted RubyGems versions attackers can cause denial of service through CPU consumption. RubyGems versions 2.1.4 and older are vulnerable. Ruby versions 1.9.0 through 2.0.0p247 are vulnerable as they contain embedded versions of RubyGems. It does not appear to be possible to exploit this vulnerability by installing a gem for RubyGems 1.8.x or newer. Vulnerable uses of RubyGems API include packaging a gem (through `gem build`, Gem::Package or Gem::PackageTask), sending user input to Gem::Version.new, Gem::Version.correct? or use of the Gem::Version::VERSION_PATTERN or Gem::Version::ANCHORED_VERSION_PATTERN constants. Notably, users of bundler that install gems from git are vulnerable if a malicious author changes the gemspec to an invalid version. The vulnerability can be fixed by changing the "*" repetition to a "?" repetition in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb. For RubyGems 2.1.x: - ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})*\s*\z/ # :nodoc: + ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/ # :nodoc: For RubyGems 2.0.x: - ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})*\s*\z/ # :nodoc: + ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/ # :nodoc: For RubyGems 1.8.x: - ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})*\s*\z/ # :nodoc: + ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/ # :nodoc: This vulnerability was discovered by Alexander Cherepanov <cherepan () mccme ru> Here are the patches for: RubyGems 2.1.x (upcoming release 2.1.5):
Attachment:
CVE-2013-XXXX.master.patch
Description:
RubyGems 2.0.x (upcoming release 2.0.10):
Attachment:
CVE-2013-XXXX.2.0.patch
Description:
RubyGems 1.8.x (upcoming release 1.8.27 and 1.8.23.2):
Attachment:
CVE-2013-XXXX.1.8.patch
Description:
Current thread:
- CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older Eric Hodel (Sep 09)
- Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older Alexander Cherepanov (Sep 14)
- Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older Kurt Seifried (Sep 16)
- Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older Eric Hodel (Sep 17)
- Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older Kurt Seifried (Sep 18)
- Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older Alexander Cherepanov (Sep 18)
- Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older Eric Hodel (Sep 18)
- Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older Eric Hodel (Sep 20)
- Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older Tomas Hoger (Sep 20)
- Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older Kurt Seifried (Sep 16)
- Re: CVE-2013-4287 Algorithmic complexity vulnerability in RubyGems 2.0.7 and older Alexander Cherepanov (Sep 14)