activesupport vulnerable to Denial of Service via large XML document depth
The (1) `jdom.rb` and (2) `rexml.rb` components in Active Support in Ruby on Rails before 3.2.22, 4.1.x before 4.1.11, and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-3227US | medium5.0 | — | ||
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause… | ||||
02
references
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-updates/2015-07/msg00050.htmlWEB
- http://openwall.com/lists/oss-security/2015/06/16/16WEB
- http://www.debian.org/security/2016/dsa-3464WEB
- https://github.com/rails/railsPACKAGE
- https://github.com/rails/rails/commit/12f763ce1131d29d24bd0d8f868e2697a139aea3WEB
- https://github.com/rails/rails/commit/153cc843ad95930b00b0ca91d30b599b7dec9680WEB
- https://github.com/rails/rails/commit/78b29e08c700d889837af6c51c7debd3864abc3dWEB
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8JWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan