rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-powerbarUpgrade rubygem-apipie-bindingsUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unfUpgrade rubygem-mime-typesUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-multi_jsonUpgrade rubygem-unicodeUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-http-acceptUpgrade rubygem-http-cookieUpgrade satellite-cliUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-display_widthUpgrade rubygem-amazing_printUpgrade rubygem-mime-types-dataUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-jwtUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-clampUpgrade rubygem-unicode-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cliUpgrade rubygem-netrcUpgrade rubygem-ffi-debuginfoUpgrade foreman-cliUpgrade rubygem-version_gemUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-little-pluggerUpgrade rubygem-hashieUpgrade rubygem-loggingUpgrade satellite-maintainUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-rest-clientUpgrade rubygem-highlineUpgrade rubygem-gssapiUpgrade rubygem-foreman_maintainUpgrade rubygem-snaky_hash | May 4, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade ruby-rails-html-sanitizer | Sep 15, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade rubygem-localeUpgrade rubygem-unicodeUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicode-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-snaky_hashUpgrade rubygem-apipie-bindingsUpgrade satellite-cloneUpgrade rubygem-multi_jsonUpgrade rubygem-amazing_printUpgrade rubygem-ffi-debugsourceUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-fast_gettextUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-jwtUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cliUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-oauth-ttyUpgrade rubygem-oauthUpgrade python39-pulp_manifestUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-domain_nameUpgrade satellite-maintainUpgrade rubygem-ffiUpgrade rubygem-rest-clientUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-highlineUpgrade foreman-cliUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-version_gemUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-clampUpgrade rubygem-http-cookieUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hashieUpgrade rubygem-unfUpgrade rubygem-powerbarUpgrade rubygem-netrcUpgrade satellite-cliUpgrade rubygem-mime-types-data | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-debuginfo | Mar 12, 2024 | Dec 14, 2022 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 7, 2024 | Dec 14, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-rails-html-sanitizer-testsuiteUpgrade ruby2.5-rubygem-rails-html-sanitizerUpgrade ruby2.5-rubygem-rails-html-sanitizer-doc | Sep 21, 2023 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub