CVE-2013-4287.yml

---
gem: rubygems-update
library: rubygems
cve: 2013-4287
osvdb: 97163
ghsa: 9j7m-rjqx-48vh
url: http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html
title: "CVE-2013-4287 rubygems: version regex algorithmic complexity vulnerability"
date: 2013-09-09
description: |
  Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN
  in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x
  before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows
  remote attackers to cause a denial of service (CPU consumption) via a crafted gem
  version that triggers a large amount of backtracking in a regular expression.
cvss_v2: 4.3
patched_versions:
  - "~> 1.8.23.1"
  - "~> 1.8.26"
  - "~> 2.0.8"
  - ">= 2.1.0"