Vulnerability Description
A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Promptworks | Redcloth | >= 4.0.0, <= 4.3.2 |
Related Weaknesses (CWE)
References
- https://github.com/e23e/CVE-2023-31606#readmeExploitThird Party Advisory
- https://github.com/jgarber/redclothProduct
- https://github.com/jgarber/redcloth/issues/73ExploitIssue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/07/msg00002.html
- https://security.gentoo.org/glsa/202401-14
- https://github.com/e23e/CVE-2023-31606#readmeExploitThird Party Advisory
- https://github.com/jgarber/redclothProduct
- https://github.com/jgarber/redcloth/issues/73ExploitIssue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/07/msg00002.html
- https://security.gentoo.org/glsa/202401-14
FAQ
What is CVE-2023-31606?
CVE-2023-31606 is a vulnerability with a CVSS score of 7.5 (HIGH). A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via sup...
How severe is CVE-2023-31606?
CVE-2023-31606 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-31606?
Check the references section above for vendor advisories and patch information. Affected products include: Promptworks Redcloth.