CVE-2008-3443

Ruby <1.8.7-p71 - DoS

Title source: llm
STIX 2.1

Description

The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick.

Exploits (1)

exploitdb WORKING POC VERIFIED
by laurent gaffié · textdosmultiple
https://www.exploit-db.com/exploits/6239

References (26)

Core 26
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31430
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/651-1/
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/33185
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2009/dsa-1695
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT3549
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/30682
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/44688
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/4158
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35074
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1021075
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0895.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0897.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/33398
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32219
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/6239
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1297
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/691-1/
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9570
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32371
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32165
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32372

Scores

EPSS 0.2925
EPSS Percentile 96.6%

Details

CWE
CWE-399
Status published
Products (10)
ruby-lang/ruby 1.6.8
ruby-lang/ruby 1.8.0
ruby-lang/ruby 1.8.1 (2 CPE variants)
ruby-lang/ruby 1.8.2 (4 CPE variants)
ruby-lang/ruby 1.8.3 (4 CPE variants)
ruby-lang/ruby 1.8.4 (4 CPE variants)
ruby-lang/ruby 1.8.5 (15 CPE variants)
ruby-lang/ruby 1.8.6 (10 CPE variants)
ruby-lang/ruby 1.8.7 (8 CPE variants)
ruby-lang/ruby 1.9.0
Published Aug 14, 2008
Tracked Since Feb 18, 2026