Regular Expression Denial Of Service (ReDoS)

🗓️ 24 Oct 2024 08:25:26Reported by Veracode Vulnerability DatabaseType

Action Pack is vulnerable to Regular Expression Denial Of Service due to inefficient header parsing.

Reporter	Title	Published	Views	Family All 57
IBM Security Bulletins	Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9.	15 Apr 202503:13	–	ibm
Circl	CVE-2024-47887	16 Oct 202423:05	–	circl
CNNVD	Rails 安全漏洞	15 Oct 202400:00	–	cnnvd
CVE	CVE-2024-47887	16 Oct 202420:02	–	cve
Cvelist	CVE-2024-47887 Action Controller has possible ReDoS vulnerability in HTTP Token authentication	16 Oct 202420:02	–	cvelist
Debian	[SECURITY] [DLA 4383-1] rails security update	25 Nov 202519:57	–	debian
Debian	[SECURITY] [DSA 5881-1] rails security update	17 Mar 202519:41	–	debian
Debian CVE	CVE-2024-47887	16 Oct 202420:02	–	debiancve
Tenable Nessus	Debian dla-4383 : rails - security update	25 Nov 202500:00	–	nessus
Tenable Nessus	Debian dsa-5881 : rails - security update	19 Mar 202500:00	–	nessus

Vulners

Node

rubyonrails railsMatch2:6.0.3.4+dfsg-1debian

AND

actionpack_project actionpackRange4.0.0.beta1–6.1.7.8ruby

actionpack_project actionpackRange7.0.0.alpha1–7.0.8.4ruby

actionpack_project actionpackRange7.1.0.beta1–7.1.4ruby

actionpack_project actionpackRange7.2.0.beta1–7.2.1ruby

Source	Link
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-47887.yml
github	www.github.com/rails/rails/commit/8e057db25bff1dc7a98e9ae72e0083825b9ac545
github	www.github.com/rails/rails/commit/7c1398854d51f9bb193fb79f226647351133d08a
github	www.github.com/rails/rails/commit/f4dc83d8926509d0958ec21fcdbc2e7df3d32ce2
github	www.github.com/rails/rails/commit/56b2fc3302836405b496e196a8d5fc0195e55049
github	www.github.com/advisories/GHSA-vfg9-r3fq-jvx4
github	www.github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4

04 Nov 2024 09:41Current

6.5Medium risk

Vulners AI Score6.5

CVSS 48.7

EPSS0.00273

SSVC