A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby-activesupport | Aug 22, 2024 | Feb 9, 2023 |
| Centos_linux | — | Upgrade foreman-cliUpgrade rubygem-unf_extUpgrade satellite-maintainUpgrade rubygem-gssapiUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-version_gemUpgrade rubygem-foreman_maintainUpgrade rubygem-hashieUpgrade rubygem-netrcUpgrade rubygem-highlineUpgrade rubygem-oauthUpgrade rubygem-hammer_cliUpgrade rubygem-localeUpgrade rubygem-rest-clientUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-domain_nameUpgrade satellite-cliUpgrade rubygem-unfUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicode-display_widthUpgrade rubygem-snaky_hashUpgrade rubygem-oauth-ttyUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-mime-typesUpgrade rubygem-amazing_printUpgrade rubygem-ffiUpgrade rubygem-little-pluggerUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicode-debugsourceUpgrade rubygem-loggingUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-powerbarUpgrade rubygem-mime-types-dataUpgrade rubygem-unicodeUpgrade rubygem-multi_jsonUpgrade rubygem-jwtUpgrade rubygem-ffi-debugsourceUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-apipie-bindings | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade rails | Mar 14, 2023 | Feb 9, 2023 |
| Redhat_linux | — | Upgrade rubygem-snaky_hashUpgrade rubygem-version_gemUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-maintainUpgrade rubygem-unicode-debuginfoUpgrade satellite-cliUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-netrcUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-ffiUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unicodeUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-foreman_maintainUpgrade rubygem-mime-types-dataUpgrade rubygem-little-pluggerUpgrade rubygem-clampUpgrade rubygem-http-cookieUpgrade rubygem-oauth-ttyUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-apipie-bindingsUpgrade rubygem-ffi-debuginfoUpgrade satellite-cloneUpgrade rubygem-domain_nameUpgrade rubygem-amazing_printUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade python39-pulp_manifestUpgrade rubygem-hashieUpgrade rubygem-rest-clientUpgrade rubygem-localeUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-jwtUpgrade rubygem-hammer_cliUpgrade rubygem-fast_gettextUpgrade rubygem-highline | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfo | Mar 5, 2024 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-activesupport-5_1Upgrade ruby2.5-rubygem-activesupport-doc-5_1 | Feb 7, 2023 | Feb 7, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub