CVE-2013-4363

Name of the Vulnerable Software and Affected Versions RubyGems versions 1.8.24 through 1.8.26 RubyGems versions prior to 1.8.23.2 RubyGems versions 2.0.x prior to 2.0.10 RubyGems versions 2.1.x prior to 2.1.5

Description The issue is related to an algorithmic complexity vulnerability in Gem::Version::ANCHORED VERSION PATTERN in lib/rubygems/version.rb. This vulnerability allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Recommendations For RubyGems versions 1.8.24 through 1.8.26, update to a version outside of this range to resolve the issue. For RubyGems versions prior to 1.8.23.2, update to version 1.8.23.2 or later to resolve the issue. For RubyGems versions 2.0.x prior to 2.0.10, update to version 2.0.10 or later to resolve the issue. For RubyGems versions 2.1.x prior to 2.1.5, update to version 2.1.5 or later to resolve the issue.