A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby-activesupport | Aug 22, 2024 | Feb 9, 2023 |
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-fast_gettextUpgrade rubygem-ffiUpgrade rubygem-little-pluggerUpgrade rubygem-amazing_printUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-powerbarUpgrade satellite-cliUpgrade rubygem-mime-types-dataUpgrade rubygem-http-acceptUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unfUpgrade rubygem-loggingUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_googleUpgrade satellite-cloneUpgrade rubygem-domain_nameUpgrade rubygem-unicode-debugsourceUpgrade rubygem-oauth-ttyUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-display_widthUpgrade rubygem-http-cookieUpgrade rubygem-unicode-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-multi_jsonUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-jwtUpgrade rubygem-ffi-debuginfoUpgrade foreman-cliUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-clampUpgrade rubygem-unf_extUpgrade rubygem-rest-clientUpgrade python39-pulp_manifestUpgrade rubygem-gssapiUpgrade rubygem-hashieUpgrade rubygem-oauthUpgrade rubygem-netrcUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-localeUpgrade rubygem-highlineUpgrade rubygem-hammer_cli | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade rails | Mar 14, 2023 | Feb 9, 2023 |
| Redhat_linux | — | Upgrade rubygem-little-pluggerUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-foreman_maintainUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-oauth-ttyUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unf_extUpgrade rubygem-localeUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-amazing_printUpgrade rubygem-apipie-bindingsUpgrade rubygem-oauthUpgrade rubygem-http-cookieUpgrade rubygem-hashieUpgrade rubygem-domain_nameUpgrade satellite-cloneUpgrade rubygem-clampUpgrade rubygem-jwtUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cliUpgrade rubygem-rest-clientUpgrade rubygem-ffi-debuginfoUpgrade python39-pulp_manifestUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-powerbarUpgrade rubygem-snaky_hashUpgrade rubygem-netrcUpgrade rubygem-http-acceptUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cliUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-ffiUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-version_gemUpgrade rubygem-multi_jsonUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-maintainUpgrade rubygem-unf_ext-debuginfo | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-debuginfo | Mar 5, 2024 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-activesupport-doc-5_1Upgrade ruby2.5-rubygem-activesupport-5_1 | Feb 7, 2023 | Feb 7, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub