A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Mar 21, 2024 | Feb 9, 2023 |
| Centos_linux | — | Upgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-gssapiUpgrade rubygem-http-acceptUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-jwtUpgrade rubygem-snaky_hashUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-http-cookieUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-oauthUpgrade rubygem-localeUpgrade foreman-cliUpgrade rubygem-apipie-bindingsUpgrade python39-pulp_manifestUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffi-debugsourceUpgrade rubygem-powerbarUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-ffi-debuginfoUpgrade rubygem-version_gemUpgrade rubygem-unicodeUpgrade rubygem-highlineUpgrade satellite-maintainUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-netrcUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-ffiUpgrade satellite-cliUpgrade rubygem-oauth-ttyUpgrade rubygem-mime-types-dataUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-foreman_maintainUpgrade rubygem-clampUpgrade rubygem-unfUpgrade rubygem-multi_json | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade rails | Mar 14, 2023 | Feb 9, 2023 |
| Redhat_linux | — | Upgrade rubygem-unf_extUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-fast_gettextUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-version_gemUpgrade rubygem-unicode-display_widthUpgrade rubygem-jwtUpgrade rubygem-netrcUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unicode-debuginfoUpgrade python39-pulp_manifestUpgrade satellite-cliUpgrade rubygem-http-acceptUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-amazing_printUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-foreman_maintainUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-highlineUpgrade rubygem-domain_nameUpgrade rubygem-hashieUpgrade rubygem-hammer_cliUpgrade rubygem-mime-types-dataUpgrade rubygem-rest-clientUpgrade rubygem-powerbarUpgrade rubygem-clampUpgrade rubygem-unfUpgrade rubygem-oauth-ttyUpgrade rubygem-http-cookieUpgrade rubygem-little-plugger | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxx | Mar 5, 2024 | Feb 9, 2023 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 21, 2023 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-actionpack-5_1Upgrade ruby2.5-rubygem-actionpack-doc-5_1 | Feb 21, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub