Skip to content
OpenAdvisories
Medium WID-SEC-2024-3205 4 CVEs

Ruby on Rails: Mehrere Schwachstellen ermöglichen Denial of Service

Published Oct 15, 2024 · Updated Nov 25, 2025 · Revision 7 · de-DE

Vendor: Debian Vendor: IBM Vendor: SUSE Vendor: Ubuntu Product: License Metric Tool Product: Linux Product: Linux Product: Linux Product: openSUSE

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework.

Vulnerabilities 4

  • Medium 6.6
    CVE-2024-41128

    Action Dispatch has possible ReDoS vulnerability in query parameter filtering

    Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatc…

    rails rails rails rails Debian Ubuntu RubyGems
  • Medium 6.6
    CVE-2024-47887

    Action Controller has possible ReDoS vulnerability in HTTP Token authentication

    Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. For appli…

    rails rails rails rails Debian Ubuntu RubyGems
  • Medium 6.6
    CVE-2024-47888

    Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node

    Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the `plain_text_for_blockquote_node helper` in Action Text. Carefully…

    rails rails rails rails Debian Ubuntu RubyGems
  • Medium 6.6
    CVE-2024-47889

    Action Mailer has possible ReDoS vulnerability in block_format

    Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the block_format helper in Action Mailer. Carefully crafted tex…

    rails rails rails rails Debian Ubuntu RubyGems

Revision history

  1. #7

    Neue Updates von Debian aufgenommen

  2. #6

    Neue Updates von openSUSE aufgenommen

  3. #5

    Neue Updates von Ubuntu aufgenommen

  4. #4

    Neue Updates von IBM aufgenommen

  5. #3

    Neue Updates von openSUSE aufgenommen

  6. #2

    Neue Updates von SUSE aufgenommen

  7. #1

    Initiale Fassung

References