A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Mar 21, 2024 | Feb 9, 2023 |
| Centos_linux | — | Upgrade satellite-maintainUpgrade rubygem-unicode-debuginfoUpgrade rubygem-netrcUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-multi_jsonUpgrade rubygem-clampUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-display_widthUpgrade rubygem-mime-types-dataUpgrade rubygem-unicodeUpgrade rubygem-highlineUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-cliUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-mime-typesUpgrade rubygem-little-pluggerUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_adminUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-gssapiUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unf_extUpgrade rubygem-apipie-bindingsUpgrade rubygem-ffi-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade satellite-cloneUpgrade rubygem-domain_nameUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-loggingUpgrade rubygem-http-cookieUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debugsourceUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-version_gemUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-jwtUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-localeUpgrade rubygem-http-acceptUpgrade rubygem-fast_gettext | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade rails | Mar 14, 2023 | Feb 9, 2023 |
| Redhat_linux | — | Upgrade rubygem-hashieUpgrade satellite-cloneUpgrade rubygem-amazing_printUpgrade rubygem-foreman_maintainUpgrade rubygem-http-cookieUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-oauthUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-apipie-bindingsUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-oauth-ttyUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-powerbarUpgrade rubygem-domain_nameUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-little-pluggerUpgrade rubygem-fast_gettextUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicode-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-version_gemUpgrade rubygem-localeUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade python39-pulp_manifestUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_tasksUpgrade satellite-maintainUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-ffiUpgrade rubygem-netrcUpgrade rubygem-multi_jsonUpgrade satellite-cliUpgrade rubygem-jwtUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-snaky_hash | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfo | Mar 5, 2024 | Feb 9, 2023 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 21, 2023 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-actionpack-doc-5_1Upgrade ruby2.5-rubygem-actionpack-5_1 | Feb 21, 2023 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub