Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-fast_gettextUpgrade rubygem-gssapiUpgrade rubygem-unicode-debugsourceUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-http-cookieUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_tasksUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-oauthUpgrade rubygem-localeUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-domain_nameUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade python39-pulp_manifestUpgrade rubygem-snaky_hashUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-jwtUpgrade rubygem-loggingUpgrade rubygem-unf_extUpgrade rubygem-unicode-debuginfoUpgrade rubygem-rest-clientUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-unicode-display_widthUpgrade rubygem-oauth-ttyUpgrade rubygem-highlineUpgrade rubygem-foreman_maintainUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_openscapUpgrade foreman-cliUpgrade rubygem-hashieUpgrade rubygem-ffiUpgrade satellite-maintainUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unfUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-cliUpgrade rubygem-unicodeUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-mime-types-data | May 4, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade ruby-loofah | Sep 15, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade rubygem-unf_ext-debugsourceUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-snaky_hashUpgrade satellite-cloneUpgrade satellite-maintainUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unfUpgrade rubygem-multi_jsonUpgrade rubygem-mime-types-dataUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-jwtUpgrade rubygem-netrcUpgrade rubygem-little-pluggerUpgrade rubygem-gssapiUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-fast_gettextUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-apipie-bindingsUpgrade rubygem-mime-typesUpgrade rubygem-localeUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-powerbarUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-cookieUpgrade rubygem-unf_extUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-highlineUpgrade rubygem-oauthUpgrade rubygem-hashieUpgrade rubygem-domain_nameUpgrade rubygem-ffiUpgrade rubygem-ffi-debuginfoUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_azure_rm | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx-debuginfo | Mar 12, 2024 | Dec 14, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-loofahUpgrade ruby2.5-rubygem-loofah-docUpgrade ruby2.5-rubygem-loofah-testsuite | Mar 30, 2023 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub