GHSA-9wrq-xvmp-xjc8 CVE-2006-4112
Rails Denial of Service vulnerability
- Severity
- High
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 3.12%
- Chance of exploitation in the next 30 days. Higher than 87.84% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
1.1.6- Upgrade rails to this version or later
Description
Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or "data loss," a different vulnerability than CVE-2006-4111.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| rails | >= 1.1.0, < 1.1.6 |
1.1.6 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rails RubyGems → 1.1.6
- bundler
bundle update rails # Gemfile: gem "rails", ">= 1.1.6"
References
Advisories
Packages
Other links
- exchange.xforce.ibmcloud.com/vulnerabilities/28364
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2006-4112.yml
- web.archive.org/web/20200301174340/http://www.securityfocus.com/bid/19454
- web.archive.org/web/20200804225700/http://www.securityfocus.com/archive/1/442934/100…
- web.archive.org/web/20200808083046/http://securitytracker.com/id
- weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure
- gentoo.org/security/en/glsa/glsa-200608-20.xml
- kb.cert.org/vuls/id/699540
- novell.com/linux/security/advisories/2006_21_sr.html
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9822-6m93-xqf4 Rails has possible XSS Vulnerability in Action Controller | Medium | Also affects rails |
| GHSA-rxq3-gm4p-5fj4 rails vulnerable to improper authentication | Critical | Also affects rails |
| GHSA-rvpq-5xqx-pfpp Ruby on Rails vulnerable to code injection | High | Also affects rails |
| GHSA-jmgf-p46x-982h rails is vulnerable to CRLF injection | Medium | Also affects rails |
| GHSA-p4c6-77gc-694x session fixation protection mechanism in cgi_process.rb in Rails | Medium | Also affects rails |
| GHSA-jwhv-rgqc-fqj5 Session fixation vulnerability in Rails | Medium | Also affects rails |
| GHSA-fjfg-q662-gm6j Moderate severity vulnerability that affects rails | Medium | Also affects rails |
| GHSA-gm25-fpmr-43fj Moderate severity vulnerability that affects rails | Medium | Also affects rails |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor