Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-http-acceptUpgrade rubygem-clampUpgrade rubygem-hammer_cliUpgrade rubygem-loggingUpgrade rubygem-ffi-debuginfoUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unf_extUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-localeUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-fast_gettextUpgrade rubygem-powerbarUpgrade python39-pulp_manifestUpgrade rubygem-amazing_printUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade satellite-cloneUpgrade rubygem-gssapiUpgrade rubygem-snaky_hashUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-domain_nameUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-multi_jsonUpgrade rubygem-rest-clientUpgrade satellite-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade foreman-cliUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicodeUpgrade rubygem-unicode-display_widthUpgrade rubygem-little-pluggerUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-mime-typesUpgrade rubygem-highlineUpgrade rubygem-oauth-ttyUpgrade rubygem-netrcUpgrade rubygem-ffiUpgrade rubygem-foreman_maintainUpgrade rubygem-unfUpgrade satellite-maintain | May 4, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade ruby-loofah | Sep 15, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-mime-typesUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-cookieUpgrade rubygem-highlineUpgrade rubygem-ffiUpgrade rubygem-ffi-debuginfoUpgrade rubygem-localeUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-powerbarUpgrade rubygem-hashieUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_extUpgrade rubygem-amazing_printUpgrade rubygem-foreman_maintainUpgrade rubygem-loggingUpgrade rubygem-version_gemUpgrade rubygem-domain_nameUpgrade foreman-cliUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_googleUpgrade python39-pulp_manifestUpgrade rubygem-oauthUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-clampUpgrade rubygem-mime-types-dataUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-snaky_hashUpgrade rubygem-rest-clientUpgrade rubygem-ffi-debugsourceUpgrade satellite-cloneUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-little-pluggerUpgrade rubygem-gssapiUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-netrcUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicodeUpgrade rubygem-oauth-tty | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-debuginfo | Mar 12, 2024 | Dec 14, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-loofahUpgrade ruby2.5-rubygem-loofah-testsuiteUpgrade ruby2.5-rubygem-loofah-doc | Mar 30, 2023 | Dec 14, 2022 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub