Summary
It was discovered that Rails did not correctly handle parsing block
formats in email service layers. An attacker could possibly use this
issue to cause a denial of service. (CVE-2024-47889)
It was discovered that Rails did not correctly handle parsing block
quotes in rich text content. An attacker could possibly use this issue
to cause a denial of service. This issue only affected Ubuntu 22.04 LTS.
(CVE-2024-47888)
It was discovered that Rails did not correctly handle parsing HTTP
token authentication headers. An attacker could possibly use this
issue to cause a denial of service. (CVE-2024-47887)
It was discovered that Rails did not correctly handle parsing query
parameters in web requests. An attacker could possibly use this issue
to cause a denial of service. (CVE-2024-41128)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | rails | 2:4.2.6-1ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | rails | 2:4.2.10-0ubuntu4+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | rails | 2:5.2.3+dfsg-3ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | rails | 2:6.1.4.1+dfsg-8ubuntu2+esm1 |
Vulnerabilities 4
-
Medium 6.6
Action Dispatch has possible ReDoS vulnerability in query parameter filtering
Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatc…
-
Medium 6.6
Action Controller has possible ReDoS vulnerability in HTTP Token authentication
Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. For appli…
-
Medium 6.6
Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node
Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the `plain_text_for_blockquote_node helper` in Action Text. Carefully…
-
Medium 6.6
Action Mailer has possible ReDoS vulnerability in block_format
Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the block_format helper in Action Mailer. Carefully crafted tex…