Skip to content

Commit 04d1e42

Browse files
authored
add CVE-2021-32823 for bindata (#483)
1 parent 91c9040 commit 04d1e42

File tree

1 file changed

+19
-0
lines changed

1 file changed

+19
-0
lines changed

Diff for: gems/bindata/CVE-2021-32823.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
gem: bindata
3+
cve: 2021-32823
4+
ghsa: hj56-84jw-67h6
5+
url: https://github.com/rubysec/ruby-advisory-db/issues/476
6+
date: 2021-05-18
7+
title: Potential Denial-of-Service in bindata
8+
description: |
9+
In bindata before version 2.4.10, there is a potential denial-of-service
10+
vulnerability. In affected versions, it is very slow for certain classes in BinData
11+
to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002,
12+
BinData::Bit<N>. In combination with `<user_input>.constantize` there is a potential
13+
for a CPU-based DoS. In version 2.4.10, bindata improved the creation time of Bits
14+
and Integers.
15+
16+
cvss_v3: 3.7
17+
18+
patched_versions:
19+
- ">= 2.4.10"

0 commit comments

Comments
 (0)