CVE-2021-32823: Potential Denial-of-Service in bindata
(updated )
In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10, bindata improved the creation time of Bits and Integers.
References
- about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-2-released/
- github.com/advisories/GHSA-hj56-84jw-67h6
- github.com/dmendel/bindata
- github.com/dmendel/bindata/blob/master/ChangeLog.rdoc
- github.com/dmendel/bindata/blob/v2.4.10/ChangeLog.rdoc
- github.com/dmendel/bindata/commit/d99f050b88337559be2cb35906c1f8da49531323
- github.com/rubysec/ruby-advisory-db/issues/476
- nvd.nist.gov/vuln/detail/CVE-2021-32823
- rubygems.org/gems/bindata
Code Behaviors & Features
Detect and mitigate CVE-2021-32823 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →