cvelist/2021/32xxx/CVE-2021-32823.json

106 lines
3.9 KiB
JSON
Raw Normal View History

2021-05-12 22:01:10 +00:00
{
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
2021-05-12 22:01:10 +00:00
"ID": "CVE-2021-32823",
"STATE": "PUBLIC",
"TITLE": "Potential Denial-of-Service in bindata"
2021-05-12 22:01:10 +00:00
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
2021-06-23 17:37:03 -06:00
"product_name": "bindata",
"version": {
"version_data": [
2021-06-23 17:37:03 -06:00
{
"version_value": "< 2.4.10"
}
]
}
}
]
2021-06-23 17:37:03 -06:00
},
"vendor_name": "dmendel"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
2021-05-12 22:01:10 +00:00
"description": {
"description_data": [
{
"lang": "eng",
2021-06-24 00:00:57 +00:00
"value": "In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the creation time of Bits and Integers."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-400 Uncontrolled Resource Consumption"
}
]
2021-05-12 22:01:10 +00:00
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/dmendel/bindata/commit/d99f050b88337559be2cb35906c1f8da49531323",
"refsource": "CONFIRM",
"url": "https://github.com/dmendel/bindata/commit/d99f050b88337559be2cb35906c1f8da49531323"
},
{
"name": "https://github.com/rubysec/ruby-advisory-db/issues/476",
"refsource": "MISC",
"url": "https://github.com/rubysec/ruby-advisory-db/issues/476"
},
{
"name": "https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-2-released/#update-bindata-dependency",
"refsource": "MISC",
"url": "https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-2-released/#update-bindata-dependency"
},
{
"name": "https://rubygems.org/gems/bindata",
"refsource": "MISC",
"url": "https://rubygems.org/gems/bindata"
},
{
"name": "https://github.com/dmendel/bindata/blob/v2.4.10/ChangeLog.rdoc#version-2410-2021-05-18-",
"refsource": "MISC",
"url": "https://github.com/dmendel/bindata/blob/v2.4.10/ChangeLog.rdoc#version-2410-2021-05-18-"
}
]
},
"source": {
"advisory": "GHSA-hj56-84jw-67h6",
"discovery": "UNKNOWN"
2021-05-12 22:01:10 +00:00
}
}