CVE-2021-32823

Katalog CVE

CVSS 3.7 · Low EPSS 1,9%

Kerentanan Uncontrolled Resource Consumption pada bindata project bindata, gitlab. Skor CVSS 3.1 3.7 (Low) menurut NVD.

Deskripsi (NVD)

In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the creation time of Bits and Integers.

Rincian

Terbit di NVD

24 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 78,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dmendel/bindata/commit/d99f050b88337559be2cb35906c1f8da49531323 patch · advisory pihak ketiga
• https://github.com/rubysec/ruby-advisory-db/issues/476 exploit · patch · advisory pihak ketiga
• https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-2-released/#update-bindata-dependen... advisory pihak ketiga
• https://github.com/dmendel/bindata/blob/v2.4.10/ChangeLog.rdoc#version-2410-2021-05-18- advisory pihak ketiga
• https://rubygems.org/gems/bindata advisory pihak ketiga