websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0127-1 advisory.

  - websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The     extension parser may take quadratic time when parsing a header containing an unclosed string parameter     value whose content is a repeating two-byte sequence of a backslash and some other character. This could     be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by     providing a malicious payload with the Sec-WebSocket-Extensions header. (CVE-2020-7663)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4366 advisory.

  - mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) (CVE-2018-3258)

  - puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL (CVE-2018-11751)

  - rack-protection: Timing attack in authenticity_token.rb (CVE-2018-1000119)

  - hibernate-validator: safeHTML validator allows XSS (CVE-2019-10219)

  - Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS (CVE-2019-12781)

  - rubygem-rack: hijack sessions by using timing attacks targeting the session id (CVE-2019-16782)

  - rubygem-secure_headers: limited header injection when using dynamic overrides with user input     (CVE-2020-5216)

  - rubygem-secure_headers: directive injection when using dynamic overrides with user input (CVE-2020-5217)

  - rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks     (CVE-2020-5267)

  - netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)

  - rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7663)

  - puppet: Arbitrary catalog retrieval (CVE-2020-7942)

  - puppet: puppet server and puppetDB may leak sensitive information via metrics API (CVE-2020-7943)

  - rubygem-rack: directory traversal in Rack::Directory (CVE-2020-8161)

  - rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names     (CVE-2020-8184)

  - jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)

  - jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)

  - jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)

  - jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)

  - hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

  - jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider (CVE-2020-10968)

  - jackson-databind: Serialization gadgets in javax.swing.JEditorPane (CVE-2020-10969)

  - jackson-databind: Serialization gadgets in org.springframework:spring-aop (CVE-2020-11619)

  - jackson-databind: serialization in weblogic/oracle-aqjms (CVE-2020-14061)

  - jackson-databind: serialization in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool     (CVE-2020-14062)

  - jackson-databind: serialization in org.jsecurity.realm.jndi.JndiRealmFactory (CVE-2020-14195)

  - foreman: unauthorized cache read on RPM-based installations through local user (CVE-2020-14334)

  - Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover     (CVE-2020-14380)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4502-1 advisory.

  - websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The     extension parser may take quadratic time when parsing a header containing an unclosed string parameter     value whose content is a repeating two-byte sequence of a backslash and some other character. This could     be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by     providing a malicious payload with the Sec-WebSocket-Extensions header. (CVE-2020-7663)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that there was a denial of service vulnerability in ruby-websocket-extensions, a library for managing long-lived HTTP 'WebSocket' connections.

The parser took quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence. This could be abused by an attacker to conduct a Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload in the Sec-WebSocket-Extensions HTTP header.

For Debian 9 'Stretch', this problem has been fixed in version 0.1.2-1+deb9u1.

We recommend that you upgrade your ruby-websocket-extensions packages.

For the detailed security status of ruby-websocket-extensions please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/ruby-websocket-extensions

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Changelog :

Remove a ReDoS vulnerability in the header parser (CVE-2020-7663)

ID	Name	Product	Family	Severity
170607	SUSE SLES15 / openSUSE 15 Security Update : rubygem-websocket-extensions (SUSE-SU-2023:0127-1)	Nessus	SuSE Local Security Checks	high
142452	RHEL 7 : Satellite 6.8 (Important) (RHSA-2020:4366)	Nessus	Red Hat Local Security Checks	critical
140647	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : websocket-extensions vulnerability (USN-4502-1)	Nessus	Ubuntu Local Security Checks	high
139703	Debian DLA-2334-1 : ruby-websocket-extensions security update	Nessus	Debian Local Security Checks	high
137127	FreeBSD : websocket-extensions -- ReDoS vulnerability (ca8327f7-a5a5-11ea-a860-08002728f74c)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2020-7663

high

Tenable Plugins

high

critical

high

high

high