CVE-2021-41817
Publication date 1 January 2022
Last updated 25 August 2025
Ubuntu priority
Description
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| ruby3.0 | 22.04 LTS jammy |
Fixed 3.0.2-7ubuntu2
|
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| ruby2.7 | ||
| 20.04 LTS focal |
Fixed 2.7.0-5ubuntu1.6
|
|
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| ruby2.5 | 18.04 LTS bionic |
Fixed 2.5.1-1ubuntu1.11
|
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| ruby2.3 | 16.04 LTS xenial |
Fixed 2.3.1-2~ubuntu16.04.16+esm2
|
| 14.04 LTS trusty | Not in release |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
7.5 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-5235-1
- Ruby vulnerabilities
- 18 January 2022
Other references
- https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/
- https://github.com/ruby/date/commit/3959accef8da5c128f8a8e2fd54e932a4fb253b0 (Fix)
- https://github.com/ruby/date/commit/8f2d7a0c7e52cea8333824bd527822e5449ed83d (v3.2.2 - followups to mimic prev behaviour)
- https://github.com/ruby/date/commit/376c65942bd1d81803f14d37351737df60ec4664 (v3.2.2 - followups to mimic prev behaviour)
- https://www.cve.org/CVERecord?id=CVE-2021-41817