CVE-2023-31606: 
Ruby vulnerability analysis and mitigation

A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability was disclosed on June 6, 2023, affecting RedCloth versions from 4.0.0 up to 4.3.2. The vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload (NVD, Debian LTS).

The vulnerability exists in the sanitize_html function which uses the regular expression pattern /<(/)([A-Za-z]\w*)(^&gt;?)(\s?/?)>/ to sanitize HTML tags. When this regex pattern matches against user-provided input, it can trigger catastrophic backtracking, leading to excessive CPU usage and processing time. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (GitHub Issue, NVD).

When exploited, this vulnerability can cause significant server-side resource consumption, leading to a denial of service condition. The attack requires no privileges or user interaction and can be executed remotely, affecting the availability of the system while maintaining no impact on confidentiality or integrity (NVD).

The vulnerability can be exploited by supplying a specially crafted payload to the sanitize_html function. The attack can be triggered using the RedCloth.new(text, [:sanitize_html]).to_html function with malicious input. The exploitation requires no special privileges or user interaction, making it relatively easy to execute (GitHub POC).

Various distributions have released patches to address this vulnerability. Debian 10 has fixed the issue in version 4.3.2-3+deb10u1, and Gentoo has released version 4.3.2-r5 to address the vulnerability. Ubuntu has also released fixes across multiple versions: 23.04 (4.3.2-4ubuntu0.23.04.1), 22.04 LTS (4.3.2-4ubuntu0.22.04.1), 20.04 LTS (4.3.2-3+deb10u1build0.20.04.1), and 18.04 LTS (4.3.2-3ubuntu0.1~esm1) (Debian LTS, Gentoo).