No access to your tenant or devices. Every item links to its source. What this means
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions. When Template#match or Template#extract processes an attacker-controlled URI beginning with the operator's leading character, optional member separators allow catastrophic backtracking and denial of service on MRI Ruby before 3.2 and JRuby. Addressable 2.9.0 incompletely remediated the earlier template issue because its tests did not reach these operator-prefixed paths. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1.
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "sporkmonger",
"product": "addressable",
"versions": [
{
"version": ">= 2.3.0, < 2.9.1",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON