CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2023-22799

A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.

Score
7.5 high
Published
2023-02-09
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
databases/rubygem-globalidrubygem-globalid0.4.2unaddressedsunpoet@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>rubygem-globalid</name>
	<range><lt>1.0.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could
	allow an attacker supplying a carefully crafted input can cause the
	regular expression engine to take an unexpected amount of time. All
	users running an affected release should either upgrade or use one of
	the workarounds immediately.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2023-22799</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2023-22799</url>
    </references>
    <dates>
      <discovery>2023-02-09</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>