StackRadar

CVE-2023-28756

High

Advisory

Published 31 Mar 2023In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.025
83rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
13
of 17,781 indexed, latest versions
Container images
16
deployed by those charts
Fix available
4 of 5
affected packages

Ruby Time component ReDoS issue

Carried by container images the latest versions of 13 of 17,781 indexed charts deploy, on 16 images.

Affected packageAffected versionsFixed inImages
timegem0.1.0, 0.2.00.1.1, 0.2.27
ruby2.7deb2.7.0-5ubuntu1.4, 2.7.0-5ubuntu1.5, 2.7.0-5ubuntu1.82.7.0-5ubuntu1.116
ruby2.3deb2.3.1-2~16.04.52.3.1-2~ubuntu16.04.16+esm72
rubybitnami2.7.4-12.7.81
ruby3.1deb3.1.2-7+deb12u1no fix listed1
OSV records
GHSA-fg7x-g82r-94qcBIT-ruby-2023-28756DEBIAN-CVE-2023-28756UBUNTU-CVE-2023-28756
Also known as
BIT-ruby-min-2023-28756, USN-6055-1, USN-6087-1

Charts affected

13 by stars
ChartLatestAffected imagesRadar Score
puppetserverpuppetserver9.5.21 of 5See more

puppetserver puppetserver 9.5.2

1 of the 5 container images this version deploys carry CVE-2023-28756.

Container imageDigestPackageFixed in
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
time@0.1.0
0.1.1

Open the chart page →

14,184
opennebulakvaps2.1.15 of 9See more

opennebula kvaps 2.1.1

5 of the 9 container images this version deploys carry CVE-2023-28756.

Container imageDigestPackageFixed in
ghcr.io/kvaps/opennebula:v5.12.0.4-1e28e0e7de11b
ruby2.7@2.7.0-5ubuntu1.5
2.7.0-5ubuntu1.11
ghcr.io/kvaps/opennebula-exporter:v5.12.0.401563adc95fd
ruby2.7@2.7.0-5ubuntu1.4
2.7.0-5ubuntu1.11
ghcr.io/kvaps/opennebula-exporter:v5.12.0.4-12b92df1143b9
ruby2.7@2.7.0-5ubuntu1.5
2.7.0-5ubuntu1.11
ghcr.io/kvaps/opennebula-flow:v5.12.0.4-1600221f0f43f
ruby2.7@2.7.0-5ubuntu1.5
2.7.0-5ubuntu1.11
ghcr.io/kvaps/opennebula-gate:v5.12.0.4-1a85e03d8bc1d
ruby2.7@2.7.0-5ubuntu1.5
2.7.0-5ubuntu1.11

Open the chart page →

113,791
puppetservercamptocamp31.0.11 of 2See more

puppetserver camptocamp3 1.0.1

1 of the 2 container images this version deploys carry CVE-2023-28756.

Container imageDigestPackageFixed in
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
time@0.1.0
0.1.1

Open the chart page →

5,886
yelbfairwinds-incubator0.1.11 of 5See more

yelb fairwinds-incubator 0.1.1

1 of the 5 container images this version deploys carry CVE-2023-28756.

Container imageDigestPackageFixed in
quay.io/fairwinds/yelb-appserver:v0.6.0fae21f06131f
ruby@2.7.4-1
2.7.8

Open the chart page →

5,089
icinga2geek-cookbookVerified publisher4.2.01 of 1See more

icinga2 geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2023-28756.

Container imageDigestPackageFixed in
jordan/icinga2:latestf75025fe8ea8
time@0.2.0
ruby3.1@3.1.2-7+deb12u1
0.2.2
no fix listed

Open the chart page →

9,077
docker-registry-browsergtaylor0.4.41 of 1See more

docker-registry-browser gtaylor 0.4.4

1 of the 1 container images this version deploys carry CVE-2023-28756.

Container imageDigestPackageFixed in
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
time@0.1.0
0.1.1

Open the chart page →

3,564
fluentd-elasticsearchkfirfer13.9.11 of 1See more

fluentd-elasticsearch kfirfer 13.9.1

1 of the 1 container images this version deploys carry CVE-2023-28756.

Container imageDigestPackageFixed in
quay.io/fluentd_elasticsearch/fluentd:v4.2.399079df58561
time@0.2.0
0.2.2

Open the chart page →

1,178
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2023-28756.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
time@0.2.0
0.2.2

Open the chart page →

12,791
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2023-28756.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
time@0.2.0
0.2.2

Open the chart page →

12,791
comacopencord1.0.01 of 9See more

comac opencord 1.0.0

1 of the 9 container images this version deploys carry CVE-2023-28756.

Container imageDigestPackageFixed in
omecproject/onos-progran:1.0.05715e5648aa0
ruby2.3@2.3.1-2~16.04.5
2.3.1-2~ubuntu16.04.16+esm7

Open the chart page →

88,546
onos-progranopencord1.2.71 of 2See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2023-28756.

Container imageDigestPackageFixed in
muluder/prograncontrollermcord:0.1.843b597a93da7
ruby2.3@2.3.1-2~16.04.5
2.3.1-2~ubuntu16.04.16+esm7

Open the chart page →

38,865
mastodonrivals-spaceVerified publisher3.1.21 of 3See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2023-28756.

Container imageDigestPackageFixed in
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
time@0.1.0
0.1.1

Open the chart page →

6,026
kongwallarmVerified publisher4.6.31 of 7See more

kong wallarm 4.6.3

1 of the 7 container images this version deploys carry CVE-2023-28756.

Container imageDigestPackageFixed in
wallarm/kong:3.1.0-ubuntu-4.6.0ea9608c82e40
ruby2.7@2.7.0-5ubuntu1.8
2.7.0-5ubuntu1.11

Open the chart page →

11,405

Container images carrying it

16 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
time@0.2.0
0.2.2
2
jordan/icinga2:latestf75025fe8ea8
time@0.2.0
ruby3.1@3.1.2-7+deb12u1
0.2.2
no fix listed
1
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
time@0.1.0
0.1.1
1
muluder/prograncontrollermcord:0.1.843b597a93da7
ruby2.3@2.3.1-2~16.04.5
2.3.1-2~ubuntu16.04.16+esm7
1
omecproject/onos-progran:1.0.05715e5648aa0
ruby2.3@2.3.1-2~16.04.5
2.3.1-2~ubuntu16.04.16+esm7
1
wallarm/kong:3.1.0-ubuntu-4.6.0ea9608c82e40
ruby2.7@2.7.0-5ubuntu1.8
2.7.0-5ubuntu1.11
1
ghcr.io/kvaps/opennebula:v5.12.0.4-1e28e0e7de11b
ruby2.7@2.7.0-5ubuntu1.5
2.7.0-5ubuntu1.11
1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.401563adc95fd
ruby2.7@2.7.0-5ubuntu1.4
2.7.0-5ubuntu1.11
1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.4-12b92df1143b9
ruby2.7@2.7.0-5ubuntu1.5
2.7.0-5ubuntu1.11
1
ghcr.io/kvaps/opennebula-flow:v5.12.0.4-1600221f0f43f
ruby2.7@2.7.0-5ubuntu1.5
2.7.0-5ubuntu1.11
1
ghcr.io/kvaps/opennebula-gate:v5.12.0.4-1a85e03d8bc1d
ruby2.7@2.7.0-5ubuntu1.5
2.7.0-5ubuntu1.11
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
time@0.1.0
0.1.1
1
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
time@0.1.0
0.1.1
1
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
time@0.1.0
0.1.1
1
quay.io/fairwinds/yelb-appserver:v0.6.0fae21f06131f
ruby@2.7.4-1
2.7.8
1
quay.io/fluentd_elasticsearch/fluentd:v4.2.399079df58561
time@0.2.0
0.2.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.