GHSA-PCQQ-5962-HVCW高危已审查

Denial of Service in uap-core when processing crafted User-Agent strings

OSV 1.4.0 · github-reviewed · 修改于 2025-05-23 01:12

发布时间

2020-03-11 02:02

GitHub 审查时间

2020-03-11 00:48

NVD 发布时间

—

源文件

advisories/github-reviewed/2020/03/GHSA-pcqq-5962-hvcw/GHSA-pcqq-5962-hvcw.json

公告说明

Impact

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

Patches

Please update uap-ruby to >= v2.6.0

For more information

https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p

Reported in uap-core by Ben Caller @bcaller

受影响的软件包

RubyGems

user_agent_parser

ECOSYSTEM

标识信息

别名 / CVE

无

CWE

无

软件生态

RubyGems

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-pcqq-5962-hvcw",
  "aliases": [],
  "details": "### Impact\nSome regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.\n\n### Patches\nPlease update `uap-ruby` to &gt;= v2.6.0\n\n### For more information\nhttps://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p\n\nReported in `uap-core` by Ben Caller @bcaller",
  "summary": "Denial of Service in uap-core when processing crafted User-Agent strings",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.0"
            }
          ]
        }
      ],
      "package": {
        "name": "user_agent_parser",
        "ecosystem": "RubyGems"
      }
    }
  ],
  "modified": "2025-05-22T17:12:55Z",
  "severity": [],
  "published": "2020-03-10T18:02:49Z",
  "references": [
    {
      "url": "https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw",
      "type": "WEB"
    },
    {
      "url": "https://github.com/ua-parser/uap-ruby/commit/2bb18268f4c5ba7d4ba0e21c296bf6437063da3a",
      "type": "WEB"
    },
    {
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/user_agent_parser/GHSA-pcqq-5962-hvcw.yml",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2020-03-10T16:48:58Z"
  }
}