GHSA-j96r-xvjq-r9pg CVE-2015-3227
activesupport vulnerable to Denial of Service via large XML document depth
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 4.26%
- Chance of exploitation in the next 30 days. Higher than 91.07% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
4.1.11- Upgrade activesupport to this version or later
Description
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 3.2.22, 4.1.x before 4.1.11, and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| activesupport | >= 4.0.0.beta1, < 4.1.11 |
4.1.11 |
| activesupport | >= 4.2.0.beta1, < 4.2.2 |
4.2.2 |
| activesupport | < 3.2.22 |
3.2.22 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
activesupport RubyGems → 4.1.11
- bundler
bundle update activesupport # Gemfile: gem "activesupport", ">= 4.1.11"
References
Advisories
Packages
Other links
- github.com/rails/rails/commit/12f763ce1131d29d24bd0d8f868e2697a139aea3
- github.com/rails/rails/commit/153cc843ad95930b00b0ca91d30b599b7dec9680
- github.com/rails/rails/commit/78b29e08c700d889837af6c51c7debd3864abc3d
- groups.google.com/forum/message/raw
- web.archive.org/web/20200228041703/http://www.securityfocus.com/bid/75234
- web.archive.org/web/20200517005133/http://www.securitytracker.com/id/1033755
- lists.opensuse.org/opensuse-updates/2015-07/msg00050.html
- openwall.com/lists/oss-security/2015/06/16/16
- debian.org/security/2016/dsa-3464
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-2j26-frm8-cmj9 Rails Active Support has a possible DoS vulnerability in its number helpers | High | Also affects activesupport |
| GHSA-89vf-4333-qx8v Rails Active Support has a possible XSS vulnerability in SafeBuffer#% | Medium | Also affects activesupport |
| GHSA-cg4j-q9v8-6v38 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited | Medium | Also affects activesupport |
| GHSA-cr5q-6q9f-rq6q Active Support Possibly Discloses Locally Encrypted Files | Medium | Also affects activesupport |
| GHSA-pj73-v5mw-pm9j Possible XSS Security Vulnerability in SafeBuffer#bytesplice | Medium | Also affects activesupport |
| GHSA-j6gc-792m-qgm2 ReDoS based DoS vulnerability in Active Support's underscore | Low | Also affects activesupport |
| GHSA-2p68-f74v-9wc6 ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore | Critical | Also affects activesupport |
| GHSA-qv8p-v9qw-wc7g activesupport Cross-site Scripting vulnerability | Medium | Also affects activesupport |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor