A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby-activesupport | Aug 22, 2024 | Feb 9, 2023 |
| Centos_linux | — | Upgrade rubygem-ffiUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-ffi-debugsourceUpgrade satellite-cliUpgrade rubygem-unfUpgrade rubygem-apipie-bindingsUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-multi_jsonUpgrade rubygem-unicodeUpgrade rubygem-jwtUpgrade rubygem-amazing_printUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-display_widthUpgrade rubygem-oauth-ttyUpgrade rubygem-snaky_hashUpgrade rubygem-http-cookieUpgrade rubygem-fast_gettextUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-http-acceptUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unicode-debugsourceUpgrade rubygem-loggingUpgrade rubygem-domain_nameUpgrade rubygem-mime-typesUpgrade rubygem-gssapiUpgrade satellite-maintainUpgrade rubygem-unf_extUpgrade foreman-cliUpgrade rubygem-oauthUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-foreman_maintainUpgrade rubygem-clampUpgrade rubygem-rest-clientUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade python39-pulp_manifestUpgrade rubygem-ffi-debuginfoUpgrade rubygem-version_gemUpgrade rubygem-highlineUpgrade rubygem-hammer_cliUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade rails | Mar 14, 2023 | Feb 9, 2023 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-foreman_maintainUpgrade rubygem-jwtUpgrade satellite-cloneUpgrade rubygem-gssapiUpgrade rubygem-little-pluggerUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-amazing_printUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hashieUpgrade rubygem-fast_gettextUpgrade rubygem-unf_extUpgrade python39-pulp_manifestUpgrade rubygem-highlineUpgrade rubygem-hammer_cliUpgrade rubygem-localeUpgrade rubygem-mime-types-dataUpgrade rubygem-unfUpgrade rubygem-oauth-ttyUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicodeUpgrade rubygem-clampUpgrade foreman-cliUpgrade rubygem-http-cookieUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-netrcUpgrade satellite-maintainUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-mime-typesUpgrade rubygem-snaky_hashUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-http-acceptUpgrade satellite-cliUpgrade rubygem-ffi-debugsourceUpgrade rubygem-powerbarUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-loggingUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_templates | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfo | Mar 5, 2024 | Feb 9, 2023 |
| Suse | — | Upgrade ruby2.5-rubygem-activesupport-5_1Upgrade ruby2.5-rubygem-activesupport-doc-5_1 | Feb 7, 2023 | Feb 7, 2023 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub