Most recent entries from all

EUVD-2026-8108

fkie_cve-2023-22799

A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.

GHSA-23c2-gwp5-pxw9 — ReDoS based DoS vulnerability in GlobalID

Affected: RubyGems: globalid

There is a ReDoS based DoS vulnerability in the GlobalID gem. This vulnerability has been assigned the CVE identifier CVE-2023-22799.

Versions Affected: >= 0.2.1 Not affected: NOTAFFECTED Fixed Versions: 1.0.1 Impact

There is a possible DoS vulnerability in the model name parsing section of the GlobalID gem. Carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases

The FIXED releases are available at the normal locations. Workarounds

There are no feasible workarounds for this issue. Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

1-0-model-name-redos.patch - Patch for 1.0 series

gsd-2023-22799

OESA-2023-1100 — rubygem-globalid security update

Affected: openEuler:20.03-LTS-SP1: rubygem-globalid

URIs for your models makes it easy to pass references around. Security Fix(es): A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.(CVE-2023-22799)

openSUSE-SU-2024:12648-1 — ruby3.1-rubygem-globalid-1.1.0-1.1 on GA media

ruby3.1-rubygem-globalid-1.1.0-1.1 on GA media

RHSA-2023:6818 — Red Hat Security Advisory: Satellite 6.14 security and bug fix update

kubeclient: kubeconfig parsing error can lead to MITM attacks openssl: c_rehash script allows command injection openssl: the c_rehash script allows command injection Pulp: Tokens stored in plaintext foreman: OS command injection via ct_command and fcct_command satellite: Blind SSRF via Referer header python-future: remote attackers can cause denial of service via crafted Set-Cookie header from malicious web server golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests rubygem-activerecord: Denial of Service rubygem-rack: denial of service in Content-Disposition parsing rubygem-rack: denial of service in Content-Disposition parsing rubygem-rack: denial of service in Content-Disposition parsing ruby-git: code injection vulnerability ruby-git: code injection vulnerability Foreman: Arbitrary code execution through templates Foreman: Stored cross-site scripting in host tab puppet: Puppet Server ReDoS rubygem-actionpack: Denial of Service in Action Dispatch rubygem-activerecord: SQL Injection rubygem-actionpack: Denial of Service in Action Dispatch rubygem-activesupport: Regular Expression Denial of Service rubygem-globalid: ReDoS vulnerability rubygem-rack: Denial of service in Multipart MIME parsing rubygem-rack: denial of service in header parsing golang: net/http: insufficient sanitization of Host header sqlparse: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service) python-django: Potential bypass o…

SUSE-SU-2023:0328-1 — Security update for rubygem-globalid

Security update for rubygem-globalid

UBUNTU-CVE-2023-22799

Affected: Ubuntu:16.04:LTS: ruby-globalid, Ubuntu:18.04:LTS: ruby-globalid, Ubuntu:20.04:LTS: ruby-globalid, Ubuntu:22.04:LTS: ruby-globalid, Ubuntu:24.04:LTS: ruby-globalid, Ubuntu:25.10: ruby-globalid, Ubuntu:26.04:LTS: ruby-globalid

WID-SEC-W-2023-2101 — genua genucenter: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in genua genucenter ausnutzen, um Informationen offenzulegen, Dateien zu manipulieren, um Cross-Site Scripting Angriffe durchzuführen oder um einen nicht näher spezifizierten Angriff durchzuführen.