2021-05-12 22:01:10 +00:00
{
"CVE_data_meta" : {
2021-06-23 15:51:11 -06:00
"ASSIGNER" : "security-advisories@github.com" ,
2021-05-12 22:01:10 +00:00
"ID" : "CVE-2021-32823" ,
2021-06-23 15:51:11 -06:00
"STATE" : "PUBLIC" ,
"TITLE" : "Potential Denial-of-Service in bindata"
2021-05-12 22:01:10 +00:00
} ,
2021-06-23 15:51:11 -06:00
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
2021-06-23 17:37:03 -06:00
"product_name" : "bindata" ,
2021-06-23 15:51:11 -06:00
"version" : {
"version_data" : [
2021-06-23 17:37:03 -06:00
{
"version_value" : "< 2.4.10"
}
2021-06-23 15:51:11 -06:00
]
}
}
]
2021-06-23 17:37:03 -06:00
} ,
"vendor_name" : "dmendel"
2021-06-23 15:51:11 -06:00
}
]
}
} ,
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
2021-05-12 22:01:10 +00:00
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2021-06-24 00:00:57 +00:00
"value" : "In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the creation time of Bits and Integers."
2021-06-23 15:51:11 -06:00
}
]
} ,
"generator" : {
"engine" : "Vulnogram 0.0.9"
} ,
"impact" : {
"cvss" : {
"attackComplexity" : "HIGH" ,
"attackVector" : "NETWORK" ,
"availabilityImpact" : "LOW" ,
"baseScore" : 3.7 ,
"baseSeverity" : "LOW" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
"privilegesRequired" : "NONE" ,
"scope" : "UNCHANGED" ,
"userInteraction" : "NONE" ,
"vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" ,
"version" : "3.1"
}
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-400 Uncontrolled Resource Consumption"
}
]
2021-05-12 22:01:10 +00:00
}
]
2021-06-23 15:51:11 -06:00
} ,
"references" : {
"reference_data" : [
{
"name" : "https://github.com/dmendel/bindata/commit/d99f050b88337559be2cb35906c1f8da49531323" ,
"refsource" : "CONFIRM" ,
"url" : "https://github.com/dmendel/bindata/commit/d99f050b88337559be2cb35906c1f8da49531323"
} ,
{
"name" : "https://github.com/rubysec/ruby-advisory-db/issues/476" ,
"refsource" : "MISC" ,
"url" : "https://github.com/rubysec/ruby-advisory-db/issues/476"
} ,
{
"name" : "https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-2-released/#update-bindata-dependency" ,
"refsource" : "MISC" ,
"url" : "https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-2-released/#update-bindata-dependency"
} ,
{
"name" : "https://rubygems.org/gems/bindata" ,
"refsource" : "MISC" ,
"url" : "https://rubygems.org/gems/bindata"
} ,
{
"name" : "https://github.com/dmendel/bindata/blob/v2.4.10/ChangeLog.rdoc#version-2410-2021-05-18-" ,
"refsource" : "MISC" ,
"url" : "https://github.com/dmendel/bindata/blob/v2.4.10/ChangeLog.rdoc#version-2410-2021-05-18-"
}
]
} ,
"source" : {
"advisory" : "GHSA-hj56-84jw-67h6" ,
"discovery" : "UNKNOWN"
2021-05-12 22:01:10 +00:00
}
}