A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby-activesupport | Aug 22, 2024 | Feb 9, 2023 |
| Centos_linux | — | Upgrade rubygem-gssapiUpgrade rubygem-highlineUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cliUpgrade rubygem-hashieUpgrade rubygem-rest-clientUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-oauthUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-netrcUpgrade rubygem-clampUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-foreman_maintainUpgrade foreman-cliUpgrade rubygem-version_gemUpgrade satellite-maintainUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-debuginfoUpgrade rubygem-domain_nameUpgrade rubygem-http-acceptUpgrade rubygem-mime-types-dataUpgrade rubygem-ffiUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-mime-typesUpgrade rubygem-amazing_printUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-jwtUpgrade rubygem-unicodeUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-display_widthUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-apipie-bindingsUpgrade satellite-cliUpgrade rubygem-unfUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-debugsourceUpgrade satellite-cloneUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_admin | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade rails | Mar 14, 2023 | Feb 9, 2023 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-http-acceptUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-ffiUpgrade rubygem-multi_jsonUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cliUpgrade rubygem-unicode-debuginfoUpgrade rubygem-mime-typesUpgrade rubygem-unicode-display_widthUpgrade satellite-maintainUpgrade rubygem-loggingUpgrade rubygem-version_gemUpgrade rubygem-netrcUpgrade rubygem-snaky_hashUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-http-cookieUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-foreman_maintainUpgrade rubygem-clampUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cliUpgrade rubygem-unf_extUpgrade foreman-cliUpgrade rubygem-unicodeUpgrade rubygem-hashieUpgrade rubygem-ffi-debuginfoUpgrade rubygem-amazing_printUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade satellite-cloneUpgrade rubygem-mime-types-dataUpgrade rubygem-oauth-ttyUpgrade rubygem-unfUpgrade rubygem-fast_gettextUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-oauthUpgrade rubygem-apipie-bindingsUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-rest-clientUpgrade rubygem-jwt | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-debuginfoUpgrade libdb-utils-debuginfo | Mar 5, 2024 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-activesupport-5_1Upgrade ruby2.5-rubygem-activesupport-doc-5_1 | Feb 7, 2023 | Feb 7, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub