Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS0zeDhyLXg2eHAtcTR2bc4AAwSe

Uncontrolled Recursion in Loofah

Summary

Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption.

Mitigation

Upgrade to Loofah >= 2.19.1.

Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.

Severity

The Loofah maintainers have evaluated this as High Severity 7.5 (CVSS3.1).

References

Permalink: https://github.com/advisories/GHSA-3x8r-x6xp-q4vm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zeDhyLXg2eHAtcTR2bc4AAwSe
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Percentage: 0.00101
EPSS Percentile: 0.42504

Identifiers: GHSA-3x8r-x6xp-q4vm, CVE-2022-23516
References: Repository: https://github.com/flavorjones/loofah
Blast Radius: 42.9

Affected Packages

rubygems:loofah
Dependent packages: 88
Dependent repositories: 519,899
Downloads: 519,136,926 total
Affected Version Ranges: >= 2.2.0, < 2.19.1
Fixed in: 2.19.1
All affected versions: 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.3.0, 2.3.1, 2.4.0, 2.5.0, 2.6.0, 2.7.0, 2.8.0, 2.9.0, 2.9.1, 2.10.0, 2.11.0, 2.12.0, 2.13.0, 2.14.0, 2.15.0, 2.16.0, 2.17.0, 2.18.0, 2.19.0
All unaffected versions: 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.3.1, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 1.0.0, 1.1.0, 1.2.0, 1.2.1, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.1.0, 2.1.1, 2.19.1, 2.20.0, 2.21.0, 2.21.1, 2.21.2, 2.21.3, 2.21.4, 2.22.0, 2.23.0, 2.23.1