CVE-2021-41817.yml

---
gem: date
cve: 2021-41817
ghsa: qg54-694p-wgpp
url: https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/
title: Regular Expression Denial of Service Vulnerability of Date Parsing Methods
date: 2021-11-15
description: |
  Date's parsing methods including `Date.parse` are using Regexps internally, some of
  which are vulnerable against regular expression denial of service. Applications and
  libraries that apply such methods to untrusted input may be affected.

  The fix limits the input length up to 128 bytes by default instead of changing the
  regexps. This is because Date gem uses many Regexps and it is possible that there are
  still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the
  limitation by explicitly passing `limit` keywords as `nil` like
  `Date.parse(str, limit: nil)`, but note that it may take a long time to parse.

  Please update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later.  You
  can use `gem update date` to update it.  If you are using bundler, please add
  `gem "date", ">= 3.2.1"` to your `Gemfile`.
cvss_v3: 7.5
patched_versions:
  - "~> 2.0.1"
  - "~> 3.0.2"
  - "~> 3.1.2"
  - ">= 3.2.1"