PT-2017-5976 · Ruby · Ruby

Postmodern · Publicado 2017-09-06 · Atualizado 2017-09-11 · CVE-2014-6438

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Ruby versions prior to 1.9.2-p330

Description: The issue allows remote attackers to cause a denial of service via a crafted string, potentially leading to catastrophic regular expression backtracking, resource consumption, or application crash. This is due to a problem in the URI.decode www form component method.

Recommendations: For versions prior to 1.9.2-p330, update to version 1.9.2-p330 or later to resolve the issue.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2014-6438

DLA-275-1

RHSA-2026:7305

RHSA-2026:7307

RHSA-2026:8838

Produtos afetados

Ruby

Referências · 5

• https://github.com/ruby/www.ruby-lang.org/issues/817 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-6438 · Nota de Segurança
• http://openwall.com/lists/oss-security/2015/07/13/6 · Nota
• http://securitytracker.com/id/1032874 · Nota
• https://ruby-lang.org/en/news/2014/08/19/ruby-1-9-2-p330-released · Aviso do Fabricante