Ubuntu.comUB:CVE-2024-26142CVE-2024-26142
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.1 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
15.7%
Rails is a web-application framework. Starting in version 7.1.0, there is a
possible ReDoS vulnerability in the Accept header parsing routines of
Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has
mitigations for this problem, so Rails applications using Ruby 3.2 or newer
are unaffected.
Notes
| Author | Note |
|---|---|
| seth-arnold | In Oneiric-Saucy, rails package is just for transition; The rails package contains actual code from vivid onward |
References
discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946
github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272
github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272 (v7.1.3.1)
github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq
github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml
launchpad.net/bugs/cve/CVE-2024-26142
nvd.nist.gov/vuln/detail/CVE-2024-26142
security-tracker.debian.org/tracker/CVE-2024-26142
www.cve.org/CVERecord?id=CVE-2024-26142
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.1 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
15.7%