CVE-2022-23517

Katalog CVE

CVSS 7.5 · High EPSS 1,5%

Kerentanan Inefficient Regular Expression Complexity pada rubyonrails rails html sanitizers, debian linux. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.

Rincian

Terbit di NVD

14 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rails/rails-html-sanitizer/commit/56c61c0cebd1e493e8ad7bca2a0191609a4a6979 patch · advisory pihak ketiga
• https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w advisory pihak ketiga
• https://hackerone.com/reports/1684163 permissions required · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/09/msg00012.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/09/msg00045.html