Denial of Service in uap-core when processing crafted User-Agent strings

ÉLEVÉEGHSA-pcqq-5962-hvcw · Published 10/03/2020 · updated 22/05/2025

En bref

GHSA-pcqq-5962-hvcw est une vulnérabilité ÉLEVÉE touchant user_agent_parser.
Correctif : mettre à jour vers 2.6.0 ou plus récent.

Package	Affected versions	Patched versions
user_agent_parser RubyGems	`< 2.6.0`	`2.6.0`

Description

Impact

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

Patches

Please update uap-ruby to >= v2.6.0

For more information

https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p

Reported in uap-core by Ben Caller @bcaller

References

ua-parser/uap-ruby security advisory · WEB
ua-parser/uap-ruby commit 2bb1826 · WEB
rubysec/ruby-advisory-db · WEB

Autres vulnérabilités de user_agent_parser

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free