A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-http-acceptUpgrade rubygem-highlineUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-little-pluggerUpgrade rubygem-snaky_hashUpgrade rubygem-hashieUpgrade rubygem-mime-typesUpgrade rubygem-netrcUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-version_gemUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-maintainUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-fast_gettextUpgrade satellite-cliUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debugsourceUpgrade python39-pulp_manifestUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-apipie-bindingsUpgrade rubygem-amazing_printUpgrade rubygem-unf_extUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-gssapiUpgrade rubygem-oauthUpgrade rubygem-unicode-debugsourceUpgrade rubygem-ffiUpgrade rubygem-http-cookieUpgrade rubygem-unicodeUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-powerbarUpgrade rubygem-loggingUpgrade rubygem-rest-clientUpgrade rubygem-multi_jsonUpgrade rubygem-mime-types-dataUpgrade rubygem-domain_name | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade rails | Mar 14, 2023 | Feb 9, 2023 |
| Redhat_linux | — | Upgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-version_gemUpgrade rubygem-mime-types-dataUpgrade rubygem-oauthUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-jwtUpgrade rubygem-oauth-ttyUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unfUpgrade rubygem-hammer_cliUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unicode-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-clampUpgrade rubygem-foreman_maintainUpgrade rubygem-amazing_printUpgrade rubygem-highlineUpgrade rubygem-fast_gettextUpgrade rubygem-rest-clientUpgrade rubygem-ffi-debuginfoUpgrade satellite-cloneUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-loggingUpgrade python39-pulp_manifestUpgrade rubygem-http-cookieUpgrade rubygem-ffi-debugsourceUpgrade rubygem-snaky_hashUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unicodeUpgrade rubygem-multi_jsonUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foremanUpgrade satellite-maintainUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-apipie-bindingsUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffiUpgrade satellite-cliUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-acceptUpgrade rubygem-unicode-display_width | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsource | Mar 5, 2024 | Feb 9, 2023 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 21, 2023 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-actionpack-5_1Upgrade ruby2.5-rubygem-actionpack-doc-5_1 | Feb 21, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub