A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Mar 21, 2024 | Feb 9, 2023 |
| Centos_linux | — | Upgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-apipie-bindingsUpgrade rubygem-ffi-debuginfoUpgrade rubygem-gssapiUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-oauthUpgrade rubygem-localeUpgrade rubygem-unicode-debugsourceUpgrade rubygem-snaky_hashUpgrade rubygem-rest-clientUpgrade rubygem-fast_gettextUpgrade rubygem-loggingUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-http-cookieUpgrade python39-pulp_manifestUpgrade rubygem-ffi-debugsourceUpgrade rubygem-powerbarUpgrade foreman-cliUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cliUpgrade rubygem-http-acceptUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade satellite-cloneUpgrade rubygem-oauth-ttyUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cliUpgrade rubygem-hashieUpgrade rubygem-mime-types-dataUpgrade rubygem-unicodeUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unfUpgrade rubygem-multi_jsonUpgrade rubygem-clampUpgrade rubygem-unicode-display_widthUpgrade rubygem-little-pluggerUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-netrcUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_tasksUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debuginfo | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade rails | Mar 14, 2023 | Feb 9, 2023 |
| Redhat_linux | — | Upgrade python39-pulp_manifestUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_extUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-localeUpgrade rubygem-version_gemUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-netrcUpgrade satellite-cliUpgrade rubygem-ffiUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_katelloUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-multi_jsonUpgrade rubygem-mime-typesUpgrade rubygem-loggingUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-http-acceptUpgrade satellite-cloneUpgrade rubygem-http-cookieUpgrade rubygem-oauth-ttyUpgrade rubygem-oauthUpgrade rubygem-hashieUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicodeUpgrade rubygem-clampUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-gssapiUpgrade rubygem-domain_nameUpgrade rubygem-apipie-bindingsUpgrade foreman-cliUpgrade rubygem-highlineUpgrade rubygem-little-pluggerUpgrade rubygem-amazing_printUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffi-debuginfo | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxx-debuginfo | Mar 5, 2024 | Feb 9, 2023 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 21, 2023 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-actionpack-doc-5_1Upgrade ruby2.5-rubygem-actionpack-5_1 | Feb 21, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub