A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

🗓️ 18 Feb 2023 08:00:00Reported by MicrosoftType

Regex DoS in Action Dispatch via If-None-Match; affects Ruby below 3.2.0; upgrade or apply workaround.

Reporter	Title	Published	Views	Family All 57
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.9 addresses multiple security vulnerabilities.	18 Jul 202313:09	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	20 Jun 202400:38	–	ibm
attackerkb	CVE-2023-22795	9 Feb 202320:15	–	attackerkb
AlpineLinux	CVE-2023-22795	9 Feb 202320:15	–	alpinelinux
BDU FSTEC	The vulnerability of the ActionDispatch component in the Ruby on Rails software framework, which allows a hacker to trigger a service failure.	12 Feb 202500:00	–	bdu_fstec
CBLMariner	CVE-2023-22795 affecting package ruby 2.6.10-1	12 Jan 202509:15	–	cbl_mariner
CBLMariner	CVE-2023-22795 affecting package ruby for versions less than 3.1.4-1	25 May 202309:38	–	cbl_mariner
Tenable Nessus	Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_6818)	1 Oct 202600:00	–	nessus
Tenable Nessus	Debian DSA-5372-1 : rails - security update	14 Mar 202300:00	–	nessus
Tenable Nessus	Fedora 38 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2023-f60cca0686)	1 Feb 202300:00	–	nessus