A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Mar 21, 2024 | Feb 9, 2023 |
| Centos_linux | — | Upgrade satellite-maintainUpgrade satellite-cliUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-little-pluggerUpgrade rubygem-mime-typesUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicodeUpgrade rubygem-unfUpgrade rubygem-foreman_maintainUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-ffiUpgrade rubygem-clampUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-mime-types-dataUpgrade rubygem-multi_jsonUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-loggingUpgrade rubygem-rest-clientUpgrade rubygem-ffi-debuginfoUpgrade rubygem-apipie-bindingsUpgrade rubygem-domain_nameUpgrade rubygem-oauthUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-http-acceptUpgrade rubygem-fast_gettextUpgrade rubygem-unf_extUpgrade python39-pulp_manifestUpgrade foreman-cliUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debugsourceUpgrade rubygem-amazing_printUpgrade rubygem-version_gemUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-snaky_hashUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-debugsourceUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-http-cookieUpgrade rubygem-gssapi | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade rails | Mar 14, 2023 | Feb 9, 2023 |
| Redhat_linux | — | Upgrade rubygem-domain_nameUpgrade rubygem-hammer_cliUpgrade rubygem-foreman_maintainUpgrade rubygem-unfUpgrade rubygem-rest-clientUpgrade rubygem-mime-types-dataUpgrade satellite-cloneUpgrade rubygem-highlineUpgrade rubygem-little-pluggerUpgrade foreman-cliUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hashieUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-cookieUpgrade rubygem-powerbarUpgrade rubygem-clampUpgrade rubygem-gssapiUpgrade rubygem-oauth-ttyUpgrade rubygem-oauthUpgrade rubygem-unicode-debuginfoUpgrade satellite-cliUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-snaky_hashUpgrade rubygem-mime-typesUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-multi_jsonUpgrade rubygem-fast_gettextUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-loggingUpgrade rubygem-unicode-debugsourceUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-localeUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade python39-pulp_manifestUpgrade rubygem-unicode-display_width | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx | Mar 5, 2024 | Feb 9, 2023 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 21, 2023 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-actionpack-doc-5_1Upgrade ruby2.5-rubygem-actionpack-5_1 | Feb 21, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub