Description
Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | ruby-actionmailer-3.2 | 3.2.6-2+deb7u1 | DSA-2887-1 |
| Debian 7 | ruby-actionpack-3.2 | 3.2.6-6+deb7u1 | DSA-2888-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | cfme +3 | 5.4.0.5-1.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | cfme-vnc-plugin | 1.0.0-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | libdnet +2 | 1.12-11.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | lshw +1 | B.02.16-4.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | netapp-manageability-sdk +1 | 4.0P1-3.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | open-vm-tools +2 | 9.2.3-5.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | prince | 9.0r2-4.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | pyliblzma | 0.5.3-7.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-bcrypt-ruby | 3.0.1-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-eventmachine | 1.0.7-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-ffi | 1.9.8-1.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-io-extra | 1.2.8-1.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-json | 1.8.2-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-nokogiri | 1.5.11-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-pg | 0.12.2-9.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-psych | 2.0.13-1.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-qpid_messaging | 0.20.2-5.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-therubyracer | 0.11.0-5.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-thin | 1.3.1-9.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | sneakernet_ca | 0.1-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | wmi | 1.3.14-1.el6cf | RHBA-2015:1100 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | actionmailer | >= 3.0.0, < 3.2.15 | 3.2.15 | GHSA-rg5m-3fqp-6px8 |
Advisories 3
- RHBA-2015:1100 Red Hat Bug Fix Advisory: CFME 5.4.0 bug fixes, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2887-1 ruby-actionmailer-3.2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2888-1 ruby-actionpack-3.2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-2887 vendor-advisory
- openSUSE-SU-2014:0009 vendor-advisory
- [ruby-security-ann] 20131016 Possible DoS Vulnerability in Action Mailer (CVE-2013-4389) mailing-list
- openSUSE-SU-2013:1931 vendor-advisory
- openSUSE-SU-2013:1928 vendor-advisory
- DSA-2888 vendor-advisory