Debian Long Term Support / LTS Security Information / 2020 / Security Information -- DLA-2334-1 ruby-websocket-extensions

Debian Security Advisory

DLA-2334-1 ruby-websocket-extensions -- LTS security update

Date Reported:

19 Aug 2020

Affected Packages:

ruby-websocket-extensions

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2020-7663.

More information:

It was discovered that there was a denial of service vulnerability in ruby-websocket-extensions, a library for managing long-lived HTTP "WebSocket" connections.

The parser took quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence. This could be abused by an attacker to conduct a Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload in the Sec-WebSocket-Extensions HTTP header.

• CVE-2020-7663

  websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

For Debian 9 Stretch, these problems have been fixed in version 0.1.2-1+deb9u1.

We recommend that you upgrade your ruby-websocket-extensions packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS