Posted by hsbt on 30 Mar 2023
We have released the time gem version 0.1.1 and 0.2.2 that has a security fix for a ReDoS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2023-28756.
The Time parser mishandles invalid strings that have specific characters. It causes an increase in execution time for parsing strings to Time objects.
A ReDoS issue was discovered in the Time gem 0.1.0 and 0.2.1 and Time library of Ruby 2.7.7.
We recommend to update the time gem to version 0.2.2 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:
- For Ruby 3.0 users: Update to
- For Ruby 3.1/3.2 users: Update to
You can use
gem update time to update it. If you are using bundler, please add
gem "time", ">= 0.2.2" to your
Unfortunately, time gem only works with Ruby 3.0 or later. If you are using Ruby 2.7, please use the latest version of Ruby.
- Ruby 2.7.7 or lower
- time gem 0.1.0
- time gem 0.2.1
Thanks to ooooooo_q for discovering this issue.
- Originally published at 2023-03-30 11:00:00 (UTC)