Regular Expression Denial Of Service (ReDoS)

2023-01-1902:04:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

activesupport

redos

vulnerability

underscore

function

methods.rb

insecure

regex

pattern

crash

application

maliciously crafted string

0.001 Low

EPSS

Percentile

43.0%

JSON

activesupport is vulnerable to Regular Expression Denial Of Service (ReDoS). The vulnerability exists due to the insecure Regex pattern used in the underscore function of methods.rb, allowing an attacker to crash the application by providing a maliciously crafted string.

CPENameOperatorVersion
activesupportle7.0.4
activesupportle6.1.7
activesupportle7.0.4
activesupportle6.1.7
rails:bullseyeeq2:6.0.3.4+dfsg-1
ruby-activesupport:3.17eq7.0.4-r0
ruby-activesupport:edgeeq7.0.4-r0
rails:sideq2:6.0.3.4+dfsg-1

Name	Operator	Version
activesupport	le	7.0.4
activesupport	le	6.1.7
activesupport	le	7.0.4
activesupport	le	6.1.7
rails:bullseye	eq	2:6.0.3.4+dfsg-1
ruby-activesupport:3.17	eq	7.0.4-r0
ruby-activesupport:edge	eq	7.0.4-r0
rails:sid	eq	2:6.0.3.4+dfsg-1