rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-ffiUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unicode-debugsourceUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-http-cookieUpgrade rubygem-powerbarUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade satellite-cloneUpgrade rubygem-multi_jsonUpgrade rubygem-unfUpgrade python39-pulp_manifestUpgrade rubygem-apipie-bindingsUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-mime-typesUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_googleUpgrade satellite-cliUpgrade rubygem-jwtUpgrade rubygem-hashieUpgrade satellite-maintainUpgrade rubygem-gssapiUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-highlineUpgrade rubygem-foreman_maintainUpgrade rubygem-netrcUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unicode-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-clampUpgrade rubygem-ffi-debugsourceUpgrade rubygem-version_gemUpgrade rubygem-oauthUpgrade rubygem-loggingUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foremanUpgrade foreman-cliUpgrade rubygem-rest-client | May 4, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade ruby-rails-html-sanitizer | Sep 15, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicode-debugsourceUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debuginfoUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-localeUpgrade satellite-cloneUpgrade rubygem-mime-typesUpgrade rubygem-apipie-bindingsUpgrade rubygem-snaky_hashUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cliUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-amazing_printUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-gssapiUpgrade rubygem-loggingUpgrade rubygem-http-cookieUpgrade rubygem-unf_extUpgrade rubygem-ffiUpgrade rubygem-mime-types-dataUpgrade satellite-maintainUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-rest-clientUpgrade rubygem-unf_ext-debuginfoUpgrade python39-pulp_manifestUpgrade rubygem-foreman_maintainUpgrade satellite-cliUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unicode-display_widthUpgrade rubygem-hashieUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foremanUpgrade foreman-cliUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-netrcUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_virt_who_configure | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsource | Mar 12, 2024 | Dec 14, 2022 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 7, 2024 | Dec 14, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-rails-html-sanitizerUpgrade ruby2.5-rubygem-rails-html-sanitizer-testsuiteUpgrade ruby2.5-rubygem-rails-html-sanitizer-doc | Sep 21, 2023 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub