A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (CVE-2023-31606) . MGASA-2023-0291 - Updated ruby-RedCloth packages fix a security vulnerability Publication date: 20 Oct 2023 URL: https://advisories.mageia.org/MGASA-2023-0291.html Type: security Affected Mageia releases: 8, 9 CVE: CVE-2023-31606 A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (CVE-2023-31606) References: - https://bugs.mageia.org/show_bug.cgi?id=32284 - https://ubuntu.com/security/notices/USN-6358-1 - https://www.cve.org/CVERecord?id=CVE-2023-31606 SRPMS: - 9/core/ruby-RedCloth-4.3.2-7.1.mga9 - 8/core/ruby-RedCloth-4.3.2-5.1.mga8 . Mageia 2023-0291 upgrades Ruby-RedCloth to mitigate a Denial of Service vulnerability and enhance overall security protocols.. Ruby RedCloth, Denial of Service, Mageia Security, Update Advisory. . LinuxSecurity.com Team
RedCloth could be made to crash if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-6358-1 September 12, 2023 ruby-redcloth vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.04 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) Summary: RedCloth could be made to crash if it received specially crafted input. Software Description: - ruby-redcloth: Textile module for Ruby Details: It was discovered that RedCloth incorrectly handled certain inputs during html sanitisation. An attacker could possibly use this issue to cause a denial of service. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04: ruby-redcloth 4.3.2-4ubuntu0.23.04.1 Ubuntu 22.04 LTS: ruby-redcloth 4.3.2-4ubuntu0.22.04.1 Ubuntu 20.04 LTS: ruby-redcloth 4.3.2-3+deb10u1build0.20.04.1 Ubuntu 18.04 LTS (Available with Ubuntu Pro): ruby-redcloth 4.3.2-3ubuntu0.1~esm1 Ubuntu 16.04 LTS (Available with Ubuntu Pro): ruby-redcloth 4.2.9-5ubuntu0.1~esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6358-1 CVE-2023-31606 Package Information: https://launchpad.net/ubuntu/+source/ruby-redcloth/4.3.2-4ubuntu0.23.04.1 https://launchpad.net/ubuntu/+source/ruby-redcloth/4.3.2-4ubuntu0.22.04.1 https://launchpad.net/ubuntu/+source/ruby-redcloth/4.3.2-3+deb10u1build0.20.04.1 . BlueFabric security flaw identified within Ubuntu releases, posing risk of service interruption stemming from improper input management.. RedCloth Vulnerability,Ubuntu Security, Denial Of Service. . LinuxSecurity.com Team
A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3480-1
Get the latest Linux and open source security news straight to your inbox.