nvd-json-data-feeds/CVE-2021/CVE-2021-327xx/CVE-2021-32740.json

{
  "id": "CVE-2021-32740",
  "sourceIdentifier": "security-advisories@github.com",
  "published": "2021-07-06T15:15:07.647",
  "lastModified": "2021-09-21T18:18:37.570",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking."
    },
    {
      "lang": "es",
      "value": "Addressable es una implementaci\u00f3n alternativa a la implementaci\u00f3n URI que forma parte de la biblioteca est\u00e1ndar de Ruby. Se presenta una vulnerabilidad de consumo de recursos no controlados despu\u00e9s de la versi\u00f3n 2.3.0 hasta la versi\u00f3n 2.7.0. Dentro de la implementaci\u00f3n de plantillas URI en Addressable, una plantilla dise\u00f1ada maliciosamente puede resultar en un consumo no controlado de recursos, conllevando a una denegaci\u00f3n de servicio cuando se compara con una URI. En el uso t\u00edpico, las plantillas no se leer\u00edan normalmente de la entrada de un usuario no fiable, pero sin embargo, ning\u00fan aviso de seguridad anterior para Addressable ha sido advertido en contra esto. Unos usuarios de las capacidades de an\u00e1lisis de Addressable, pero no de las capacidades de plantillas URI, no est\u00e1n afectados. La vulnerabilidad est\u00e1 parcheada en la versi\u00f3n 2.8.0. Como soluci\u00f3n, s\u00f3lo cree objetos de Plantilla desde fuentes confiables que hayan sido comprobadas para no producir retrocesos catastr\u00f3ficos"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      },
      {
        "source": "security-advisories@github.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "security-advisories@github.com",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "source": "nvd@nist.gov",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:addressable_project:addressable:*:*:*:*:*:ruby:*:*",
              "versionStartIncluding": "2.3.0",
              "versionEndExcluding": "2.8.0",
              "matchCriteriaId": "191A63ED-0569-4464-8354-7C78720CCCC5"
            }
          ]
        }
      ]
    },
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/sporkmonger/addressable/commit/0d8a3127e35886ce9284810a7f2438bff6b43cbc",
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Release Notes",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/sporkmonger/addressable/security/advisories/GHSA-jxhc-q857-3j6g",
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SDFQM2NHNAZ3NNUQZEJTYECYZYXV4UDS/",
      "source": "security-advisories@github.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYPVOOQU7UB277UUERJMCNQLRCXRCIQ5/",
      "source": "security-advisories@github.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}