What is GHSA-jrfj-98qg-qjgv?

GHSA-jrfj-98qg-qjgv is a security advisory published by GitHub Security Advisories with High severity. Denial of service in sidekiq

Which CVE IDs does GHSA-jrfj-98qg-qjgv cover?

GHSA-jrfj-98qg-qjgv covers the following CVE IDs: CVE-2022-23837. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jrfj-98qg-qjgv?

GHSA-jrfj-98qg-qjgv has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-jrfj-98qg-qjgv?

GHSA-jrfj-98qg-qjgv affects 2 products, including: rubygems/sidekiq:\u003e= 6.0.0, \u003c 6.4.0; rubygems/sidekiq:\u003c 5.2.10.

GHSA-jrfj-98qg-qjgvHighCVSS 7.5

Denial of service in sidekiq

Vendor

GitHub Security Advisories

Published

January 27, 2022

Last Modified

January 24, 2023

🔗 CVE IDs covered (1)

CVE-2022-23837 →

📋 Description

In api.rb in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.

🎯 Affected products2

rubygems/sidekiq:>= 6.0.0, < 6.4.0
rubygems/sidekiq:< 5.2.10

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2022-23837
https://github.com/mperham/sidekiq/commit/7785ac1399f1b28992adb56055f6acd88fd1d956
https://github.com/TUTUMSPACE/exploits/blob/main/sidekiq.md
https://github.com/rubysec/ruby-advisory-db/pull/495
https://lists.debian.org/debian-lts-announce/2022/03/msg00015.html
https://github.com/advisories/GHSA-jrfj-98qg-qjgv