Groups > linux.debian.bugs.dist > #1214429

Bug#1082874: ruby-fugit: CVE-2024-43380

From	Moritz Mühlenhoff <jmm@inutil.org>
Newsgroups	linux.debian.bugs.dist
Subject	Bug#1082874: ruby-fugit: CVE-2024-43380
Date	2024-09-27 15:40 +0200
Message-ID	<Jrjmp-fd5b-3@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Source: ruby-fugit
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for ruby-fugit.

CVE-2024-43380[0]:
| fugit contains time tools for flor and the floraison group. The
| fugit "natural" parser, that turns "every wednesday at 5pm" into "0
| 17 * * 3", accepted any length of input and went on attempting to
| parse it, not returning promptly, as expected. The parse call could
| hold the thread with no end in sight. Fugit dependents that do not
| check (user) input length for plausibility are impacted. A fix was
| released in fugit 1.11.1.

https://github.com/floraison/fugit/security/advisories/GHSA-2m96-52r3-2f3g
https://github.com/floraison/fugit/issues/104
https://github.com/floraison/fugit/commit/6a7527497c0bb9196efe503e3d9b5271128a8ee1 (v1.11.1)
https://github.com/floraison/fugit/commit/2a11805444d9ed036ee8570b88cd2b6df450ee84 (v1.11.1)
https://github.com/floraison/fugit/commit/a9a262873450eaf5671747f846a6ec1e5f7d87c1 (v1.11.1)
https://github.com/floraison/fugit/commit/025ad7bb76590d3360750d5617b235a23908e5bb (v1.11.1)
https://github.com/floraison/fugit/commit/767ef550281bcdc8782233840f98cf8487340476 (v1.11.1)
https://github.com/floraison/fugit/commit/ad2c1c9c737213d585fff0b51c927d178b2c05a5 (v1.11.1)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-43380
    https://www.cve.org/CVERecord?id=CVE-2024-43380

Please adjust the affected versions in the BTS as needed.

Back to linux.debian.bugs.dist | Previous | Next | Find similar | Unroll thread

Thread

Bug#1082874: ruby-fugit: CVE-2024-43380 Moritz Mühlenhoff <jmm@inutil.org> - 2024-09-27 15:40 +0200

csiph-web