A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Mar 21, 2024 | Feb 9, 2023 |
| Centos_linux | — | Upgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade python39-pulp_manifestUpgrade rubygem-amazing_printUpgrade foreman-cliUpgrade rubygem-ffi-debugsourceUpgrade rubygem-gssapiUpgrade satellite-cloneUpgrade rubygem-oauthUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-snaky_hashUpgrade rubygem-unicode-debugsourceUpgrade rubygem-loggingUpgrade rubygem-jwtUpgrade rubygem-rest-clientUpgrade rubygem-version_gemUpgrade rubygem-unf_extUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-http-acceptUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-apipie-bindingsUpgrade satellite-maintainUpgrade rubygem-multi_jsonUpgrade rubygem-mime-typesUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-ffiUpgrade rubygem-highlineUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foremanUpgrade satellite-cliUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hashieUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-mime-types-dataUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicodeUpgrade rubygem-oauth-ttyUpgrade rubygem-unfUpgrade rubygem-foreman_maintain | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade rails | Mar 14, 2023 | Feb 9, 2023 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foremanUpgrade rubygem-jwtUpgrade rubygem-unicode-debugsourceUpgrade rubygem-loggingUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unf_extUpgrade rubygem-mime-typesUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unicode-debuginfoUpgrade rubygem-localeUpgrade rubygem-snaky_hashUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-netrcUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade satellite-maintainUpgrade rubygem-ffiUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicodeUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-amazing_printUpgrade rubygem-gssapiUpgrade rubygem-apipie-bindingsUpgrade foreman-cliUpgrade rubygem-highlineUpgrade rubygem-ffi-debuginfoUpgrade rubygem-clampUpgrade rubygem-mime-types-dataUpgrade rubygem-little-pluggerUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cliUpgrade rubygem-unfUpgrade rubygem-domain_nameUpgrade rubygem-hashieUpgrade rubygem-oauthUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-oauth-ttyUpgrade rubygem-http-cookieUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-foreman_maintain | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfo | Mar 5, 2024 | Feb 9, 2023 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 21, 2023 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-actionpack-doc-5_1Upgrade ruby2.5-rubygem-actionpack-5_1 | Feb 21, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub