PT-2015-6104 · Ruby+3 · Ruby On Rails+4

Tomek Rabczak · Publicado 2015-07-26 · Atualizado 2026-03-13 · CVE-2015-3225

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Rack versions prior to 1.5.4 Rack versions 1.6.x prior to 1.6.2

Description The issue allows remote attackers to cause a denial of service, resulting in a SystemStackError, via a request with a large parameter depth. This affects products that use Rack, including Ruby on Rails 3.x and 4.x.

Recommendations For Rack version prior to 1.5.4, update to version 1.5.4 or later. For Rack version 1.6.x prior to 1.6.2, update to version 1.6.2 or later.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

CESA-2015_2290

CVE-2015-3225

DLA-254-1

DSA-3322-1

GHSA-9VC2-P34X-JHXH

GHSA-RGR4-9JH5-J4J6

MGASA-2015-0346

OPENSUSE-SU-2024:10406-1

OPENSUSE-SU-2024:11344-1

OPENSUSE-SU-2024:11345-1

OPENSUSE-SU-2024:11346-1

OPENSUSE-SU-2024:12119-1

OPENSUSE-SU-2024:12397-1

OPENSUSE-SU-2024:12974-1

OPENSUSE-SU-2024:13167-1

OPENSUSE-SU-2024:13726-1

OPENSUSE-SU-2024:13727-1

OPENSUSE-SU-2025:14811-1

OPENSUSE-SU-2025:14875-1

OPENSUSE-SU-2026:10286-1

OPENSUSE-SU-2026:10358-1

RHSA-2015:2290

RHSA-2015_2290

SUSE-SU-2015:1522-1

SUSE-SU-2015:1888-1

SUSE-SU-2015:2190-1

SUSE-SU-2015:2274-1

SUSE-SU-2015_1522-1

SUSE-SU-2015_1888-1

SUSE-SU-2015_2190-1

Produtos afetados

Centos

Rack

Red Hat

Ruby On Rails

Suse

Referências · 77

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2015-3225.yml · Exploit
• https://github.com/rack/rack · Nota
• https://github.com/rack/rack/blob/master/HISTORY.md · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/06/16/14 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164173.html · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=16220 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:12974-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:12119-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2022-44571 · Nota
• https://osv.dev/vulnerability/GHSA-rgr4-9jh5-j4j6 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-27111 · Nota
• https://cve.org/CVERecord?id=CVE-2015-3225 · Nota de Segurança
• http://lists.opensuse.org/opensuse-updates/2015-07/msg00044.html · Aviso do Fabricante
• https://lists.opensuse.org/archives/list/[e-mail]/thread/MOZFATD6SCQREBY3SZW5KQJPN6KN7A6D · Nota
• https://osv.dev/vulnerability/SUSE-SU-2015:1522-1 · Aviso do Fabricante