Regular Expression Denial Of Service (ReDoS)

🗓️ 24 Oct 2024 08:53:48Reported by Veracode Vulnerability DatabaseType

Action Text is vulnerable to Regular Expression Denial Of Service, causing potential Denial of Service attack.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9.	15 Apr 202503:13	–	ibm
Circl	CVE-2024-47888	16 Oct 202423:55	–	circl
CNNVD	Rails 安全漏洞	15 Oct 202400:00	–	cnnvd
CVE	CVE-2024-47888	16 Oct 202420:31	–	cve
Cvelist	CVE-2024-47888 Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node	16 Oct 202420:31	–	cvelist
Debian	[SECURITY] [DLA 4383-1] rails security update	25 Nov 202519:57	–	debian
Debian	[SECURITY] [DSA 5881-1] rails security update	17 Mar 202519:41	–	debian
Debian CVE	CVE-2024-47888	16 Oct 202420:31	–	debiancve
Tenable Nessus	Debian dla-4383 : rails - security update	25 Nov 202500:00	–	nessus
Tenable Nessus	Debian dsa-5881 : rails - security update	19 Mar 202500:00	–	nessus

Vulners

Node

rubyonrails railsMatch2:6.0.3.4+dfsg-1debian

AND

actiontext actiontextRange6.0.0.beta1–6.1.7.8ruby

actiontext actiontextRange7.0.0.alpha1–7.0.8.4ruby

actiontext actiontextRange7.1.0.beta1–7.1.4ruby

actiontext actiontextRange7.2.0.beta1–7.2.1ruby

Source	Link
github	www.github.com/rails/rails/commit/727b0946c3cab04b825c039435eac963d4e91822
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/actiontext/CVE-2024-47888.yml
github	www.github.com/rails/rails/commit/4f4312b21a6448336de7c7ab0c4d94b378def468
github	www.github.com/rails/rails/commit/ba286c0a310b7f19cf5cac2a7a4c9def5cf9882e
github	www.github.com/rails/rails/commit/de0df7caebd9cb238a6f10dca462dc5f8d5e98b5
github	www.github.com/advisories/GHSA-wwhv-wxv9-rpgw
github	www.github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw

04 Nov 2024 09:58Current

6.1Medium risk

Vulners AI Score6.1

CVSS 48.7

EPSS0.00476

SSVC