GoogleOSV:GHSA-QH4W-7PW3-P4RPBSON rubygem contains potential denial of service
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.034 Low
EPSS
Percentile
91.2%
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.
References
lists.fedoraproject.org/pipermail/package-announce/2015-July/161964.html
lists.fedoraproject.org/pipermail/package-announce/2015-July/161987.html
www.openwall.com/lists/oss-security/2015/06/06/3
bugzilla.redhat.com/show_bug.cgi?id=1229706
github.com/advisories/GHSA-qh4w-7pw3-p4rp
github.com/mongodb/bson-ruby
github.com/mongodb/bson-ruby/commit/976da329ff03ecdfca3030eb6efe3c85e6db9999
github.com/mongodb/bson-ruby/commit/fef6f75413511d653c76bf924a932374a183a24f#diff-8c8558c185bbb548ccb5a6d6ac4bfee5R191
github.com/mongodb/bson-ruby/compare/7446d7c6764dfda8dc4480ce16d5c023e74be5ca...28f34978a85b689a4480b4d343389bf4886522e7
github.com/mongoid/moped/commit/dd5a7c14b5d2e466f7875d079af71ad19774609b#diff-3b93602f64c2fe46d38efd9f73ef5358R24
github.com/rubysec/ruby-advisory-db/blob/master/gems/bson/CVE-2015-4411.yml
homakov.blogspot.ru/2012/05/saferweb-injects-in-various-ruby.html
nvd.nist.gov/vuln/detail/CVE-2015-4411
sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html
seclists.org/oss-sec/2015/q2/653
security-tracker.debian.org/tracker/CVE-2015-4411
web.archive.org/web/20200228085849/www.securityfocus.com/bid/75045
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.034 Low
EPSS
Percentile
91.2%