GHSA-35c4-f3rq-f9g3
Moderate severity vulnerability that affects activesupport
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
4.1.11- Upgrade activesupport to this version or later
Description
Withdrawn, accidental duplicate publish.
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| activesupport | >= 4.0.0, < 4.1.11 |
4.1.11 |
| activesupport | >= 4.2.0, < 4.2.2 |
4.2.2 |
| activesupport | >= 3.2.0, < 3.2.22 |
3.2.22 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
activesupport RubyGems → 4.1.11
- bundler
bundle update activesupport # Gemfile: gem "activesupport", ">= 4.1.11"
References
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-2j26-frm8-cmj9 Rails Active Support has a possible DoS vulnerability in its number helpers | High | Also affects activesupport |
| GHSA-89vf-4333-qx8v Rails Active Support has a possible XSS vulnerability in SafeBuffer#% | Medium | Also affects activesupport |
| GHSA-cg4j-q9v8-6v38 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited | Medium | Also affects activesupport |
| GHSA-cr5q-6q9f-rq6q Active Support Possibly Discloses Locally Encrypted Files | Medium | Also affects activesupport |
| GHSA-pj73-v5mw-pm9j Possible XSS Security Vulnerability in SafeBuffer#bytesplice | Medium | Also affects activesupport |
| GHSA-j6gc-792m-qgm2 ReDoS based DoS vulnerability in Active Support's underscore | Low | Also affects activesupport |
| GHSA-2p68-f74v-9wc6 ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore | Critical | Also affects activesupport |
| GHSA-qv8p-v9qw-wc7g activesupport Cross-site Scripting vulnerability | Medium | Also affects activesupport |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor