Bug 484476 – <dev-ruby/rubygems-2.0.10: Algorithmic complexity vulnerability (CVE-2013-{4287,4363})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2013-09-10 14:04:36 UTC]

From ${URL} :

RubyGems validates versions with a regular expression that is vulnerable to
denial of service due to backtracking.  For specially crafted RubyGems
versions attackers can cause denial of service through CPU consumption.

RubyGems versions 2.0.7 and older, 2.1.0.rc.1 and 2.1.0.rc.2 are vulnerable.

Ruby versions 1.9.0 through 2.0.0p247 are vulnerable as they contain embedded
versions of RubyGems.

It does not appear to be possible to exploit this vulnerability by installing a
gem for RubyGems 1.8.x or 2.0.x.  Vulnerable uses of RubyGems API include
packaging a gem (through `gem build`, Gem::Package or Gem::PackageTask),
sending user input to Gem::Version.new, Gem::Version.correct? or use of the
Gem::Version::VERSION_PATTERN or Gem::Version::ANCHORED_VERSION_PATTERN
constants.

Notably, users of bundler that install gems from git are vulnerable if a
malicious author changes the gemspec to an invalid version.

The vulnerability can be fixed by changing the first grouping to an atomic
grouping in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb.  For
RubyGems 2.0.x:

  -  VERSION_PATTERN = '[0-9]+(\.[0-9a-zA-Z]+)*(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?' # :nodoc:
  +  VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?' # :nodoc:

For RubyGems 1.8.x:

  -  VERSION_PATTERN = '[0-9]+(\.[0-9a-zA-Z]+)*' # :nodoc:
  +  VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*' # :nodoc:

This vulnerability was discovered by Damir Sharipov <dammer2k@...il.com>

The above information is also posted at:

http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html

Patches were committed for:

RubyGems 2.1.0.rc.2, released as RubyGems 2.1.0:

https://github.com/rubygems/rubygems/commit/938a7e31ac73655845ab9045629ff3f580a125da

RubyGems 2.0.7, released as RubyGems 2.0.8:

https://github.com/rubygems/rubygems/commit/b9baec03145aed684d1cd3c87dcac3cc06becd9b

RubyGems 1.8.25, released as RubyGems 1.8.26:

https://github.com/rubygems/rubygems/commit/ed733bc379d75620f5be4213f89d1d7b38be3191

RubyGems 1.8.23, released as RubyGems 1.8.23.1:

https://github.com/rubygems/rubygems/commit/b697536f2455e8c8853cf5cf8a1017a36031ed67

The following program can be used to test if you are vulnerable to CVE-2013-4287:


require 'benchmark'
require 'rubygems'

valid = Benchmark.measure do
  Gem::Version.new '1.22.333.4444.55555.666666.7777777'
end

puts 'Valid version time:'
puts valid

invalid = Benchmark.measure do
  begin
    Gem::Version.new '1.22.333.4444.55555.666666.7777777.'
  rescue
  end
end

puts 'Invalid version time:'
puts invalid

n = (valid.real - invalid.real).abs

if 0.1 < n then
  puts 'You are vulnerable to CVE-2013-4287.'
else
  puts 'You are NOT vulnerable to CVE-2013-4287.'
end


@maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.

[Comment 1 Hans de Graaff 2013-09-10 18:53:34 UTC]

rubygems 2.0.8 is now in the tree, but I believe that we should test this version for at least a week before starting stabilization.

[Comment 2 Agostino Sarubbo 2013-09-10 19:04:01 UTC]

(In reply to Hans de Graaff from comment #1)
> rubygems 2.0.8 is now in the tree, but I believe that we should test this
> version for at least a week before starting stabilization.

Well, tell me if I can help with build something.

[Comment 3 Agostino Sarubbo 2013-09-21 07:24:48 UTC]

http://www.openwall.com/lists/oss-security/2013/09/18/1 :

This patch does not fix the issue

CVE-2013-4363 has been assigned.

[Comment 4 Hans de Graaff 2013-09-22 17:21:52 UTC]

Upstream mentions a new release is scheduled for Sep 23rd. We'll wait for that.

[Comment 5 Hans de Graaff 2013-10-03 05:31:28 UTC]

rubygems 2.0.10 is now in the tree and should fix the remaining issues. A few days of testing and then we should be good to go.

[Comment 6 GLSAMaker/CVETool Bot 2013-10-24 00:12:18 UTC]

CVE-2013-4363 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4363):
  Algorithmic complexity vulnerability in
  Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in
  RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and
  2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote
  attackers to cause a denial of service (CPU consumption) via a crafted gem
  version that triggers a large amount of backtracking in a regular
  expression.  NOTE: this issue is due to an incomplete fix for CVE-2013-4287.

CVE-2013-4287 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4287):
  Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in
  lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25,
  2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through
  2.0.0p247, allows remote attackers to cause a denial of service (CPU
  consumption) via a crafted gem version that triggers a large amount of
  backtracking in a regular expression.

[Comment 7 Hans de Graaff 2014-11-01 07:47:03 UTC]

rubygems 2.0.14 is now stable for all arches and older versions affected by this bug have been removed.

[Comment 8 Manuel Rüger (RETIRED) 2015-07-02 09:44:52 UTC]

Vulnerable packages have been removed. 

GLSA Coordinators: Please cast your votes.

[Comment 9 Kristian Fiskerstrand (RETIRED) 2015-07-02 10:32:03 UTC]

GLSA Vote: No

[Comment 10 Mikle Kolyada (RETIRED) 2015-07-02 11:00:55 UTC]

GLSA vote: no.