activesupport vulnerable to Denial of Service via large XML document depth
The (1) `jdom.rb` and (2) `rexml.rb` components in Active Support in Ruby on Rails before 3.2.22, 4.1.x before 4.1.11, and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2015-3227US | medium5.0 | — | ||
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-updates/2015-07/msg00050.htmlWEB
- http://openwall.com/lists/oss-security/2015/06/16/16WEB
- http://www.debian.org/security/2016/dsa-3464WEB
- https://github.com/rails/railsPACKAGE
- https://github.com/rails/rails/commit/12f763ce1131d29d24bd0d8f868e2697a139aea3WEB
- https://github.com/rails/rails/commit/153cc843ad95930b00b0ca91d30b599b7dec9680WEB
- https://github.com/rails/rails/commit/78b29e08c700d889837af6c51c7debd3864abc3dWEB
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8JWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan