CVE-2023-22796

{
  "id": "CVE-2023-22796",
  "sourceIdentifier": "[email protected]",
  "published": "2023-02-09T20:15:11.487",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad DoS basada en expresiones regulares en Active Support anterior a 6.1.7.1 y anterior a 7.0.4.1. Una cadena especialmente diseñada pasada al método underscore puede hacer que el motor de expresiones regulares entre en un estado de retroceso catastrófico. Esto puede hacer que el proceso utilice grandes cantidades de CPU y memoria, lo que lleva a una posible vulnerabilidad DoS."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "https://github.com/rails/rails",
          "versions": [
            {
              "version": "6.1.7.1, 7.0.4.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2024-02-05T21:51:29.512010Z",
          "id": "CVE-2023-22796",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:activesupport_project:activesupport:*:*:*:*:*:ruby:*:*",
              "versionEndExcluding": "6.1.7.1",
              "matchCriteriaId": "989A015C-DF4F-4BCF-8637-8CF3094447A3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:activesupport_project:activesupport:*:*:*:*:*:ruby:*:*",
              "versionStartIncluding": "7.0.0",
              "versionEndExcluding": "7.0.4.1",
              "matchCriteriaId": "EB170255-D891-41DD-A250-C86AF089E5DF"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://discuss.rubyonrails.org/t/cve-2023-22796-possible-redos-based-dos-vulnerability-in-active-supports-underscore/82116",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20240202-0009/",
      "source": "[email protected]"
    },
    {
      "url": "https://www.debian.org/security/2023/dsa-5372",
      "source": "[email protected]"
    },
    {
      "url": "https://discuss.rubyonrails.org/t/cve-2023-22796-possible-redos-based-dos-vulnerability-in-active-supports-underscore/82116",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20240202-0009/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2023/dsa-5372",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}