-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| time | rubygems | >= 0.2.0, < 0.2.2 | 0.2.2 |
| time | rubygems | < 0.1.1 | 0.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability (CVE-2023-28756) is a ReDoS issue in Ruby's Time parser, linked to inefficient regex patterns. ReDoS typically stems from regex with exponential backtracking. The Time.parse and Time.xmlschema methods are core parsing functions in Ruby's Time module, which would use regex to interpret date/time strings. The fixed versions (0.1.1/0.2.2) likely modified these regex patterns to prevent backtracking. The CWE-1333 classification and the focus on Time parsing align with these functions being the vulnerable points.
RubyRubyOngoing coverage of React2Shell