Possible ReDoS vulnerability in block_format in Action Mailer

🗓️ 15 Oct 2024 23:35:38Reported by GitHub Advisory DatabaseType

Possible ReDoS vulnerability in Action Mailer block_forma

Reporter	Title	Published	Views	Family All 58
IBM Security Bulletins	Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9.	15 Apr 202503:13	–	ibm
Tenable Nessus	actionmailer Ruby Library 3.x < 6.1.7.9 / 7.0.x < 7.0.8.5 / 7.1.x < 7.1.4.1 / 7.2.x < 7.2.1.1 DoS (CVE-2024-47889)	18 Oct 202400:00	–	nessus
Tenable Nessus	Debian dla-4383 : rails - security update	25 Nov 202500:00	–	nessus
Tenable Nessus	Debian dsa-5881 : rails - security update	19 Mar 202500:00	–	nessus
Tenable Nessus	SUSE SLES15 Security Update : rubygem-actionmailer-5_1 (SUSE-SU-2024:3878-1)	2 Nov 202400:00	–	nessus
Tenable Nessus	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Rails vulnerabilities (USN-7290-1)	25 Feb 202500:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2024-47889	6 Mar 202500:00	–	nessus
BDU FSTEC	The vulnerability of the `block_format` function in the Action Text interpreter for Ruby allows a hacker to trigger a service failure.	14 Nov 202400:00	–	bdu_fstec
Circl	CVE-2024-47889	16 Oct 202423:55	–	circl
CNNVD	Rails 安全漏洞	15 Oct 202400:00	–	cnnvd

Vulners

Node

actionmailerRange7.2.0–7.2.1.1rubygems

actionmailerRange7.1.0–7.1.4.1rubygems

actionmailerRange7.0.0–7.0.8.5rubygems

actionmailerRange3.0.0–6.1.7.9rubygems

Source	Link
github	www.github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/actionmailer/CVE-2024-47889.yml
github	www.github.com/advisories/GHSA-h47h-mwp9-c6q6

07 Jan 2025 21:47Current

9.3High risk

Vulners AI Score9.3

CVSS 48.7

EPSS0.00937

SSVC