Skip to content
OpenAdvisories
High · 7.5 CVE-2019-5419 EUVD-2019-0386GHSA-m63j-wh5w-c252

Denial of Service Vulnerability in Action View

Published Mar 27, 2019 · Updated Aug 4, 2024 · Assigned by hackerone

Vendor: rails Product: https://github.com/rails/rails Package: actionview Package: rails Package: rails Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.

Affected products

VendorProductAffectedFixed
Rails https://github.com/rails/rails 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rails 2:5.2.2.1+dfsg-1 —
Debian 13 rails 2:5.2.2.1+dfsg-1 —
Debian 12 rails 2:5.2.2.1+dfsg-1 —
Debian 8 rails 2:4.1.8-1+deb8u5 DLA-1739-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS rails No fix yet —
Ubuntu Pro 16.04 LTS rails No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 3 rh-ror42-rubygem-actionpack +1 1:4.2.6-5.el6 RHSA-2019:1149
RHEL 3 rh-ror50-rubygem-actionpack +1 1:5.0.1-2.el6 RHSA-2019:1147
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat CloudForms 5 ansible-tower +5 3.4.3-1.el7at RHSA-2019:0796
Red Hat CloudForms 5 cfme +5 5.9.9.3-1.el7cf RHSA-2019:1289, RHSA-2019:0796

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP2 rmt-server 2.6.5-3.3.1 SUSE-SU-2020:3036-1
SLES 15 SP1 rmt-server 2.3.1-3.3.3 SUSE-SU-2020:3160-1, SUSE-SU-2019:1973-1
SLES 15 rmt-server 2.1.4-3.17.1 SUSE-SU-2020:3147-1, SUSE-SU-2019:1381-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 rmt-server 2.6.5-3.34.1 SUSE-SU-2020:3147-1
SLE HPC 15 rmt-server 2.6.5-3.34.1 SUSE-SU-2020:3147-1
SUSE OpenStack Cloud Crowbar 8 rubygem-actionpack-4_2 4.2.9-7.6.1 SUSE-SU-2019:0915-1
SUSE OpenStack Cloud 7 rubygem-actionpack-4_2 4.2.9-7.6.1 SUSE-SU-2019:0915-1
SUSE Enterprise Storage 4 rubygem-actionpack-4_2 4.2.9-7.6.1 SUSE-SU-2019:0915-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rmt-server 2.6.13-1.1 openSUSE-SU-2024:10589-1
openSUSE Leap 15.2 rmt-server 2.6.5-lp152.2.3.1 openSUSE-SU-2020:1993-1
openSUSE Leap 15.1 rmt-server 2.3.1-lp151.2.3.1 openSUSE-SU-2020:2000-1, openSUSE-SU-2019:1824-1
openSUSE Leap 15.0 rmt-server 2.1.4-lp150.2.16.1 openSUSE-SU-2019:1527-1
openSUSE Leap 15.0 rubygem-actionpack-5_1 5.1.4-lp150.2.3.1 openSUSE-SU-2019:1344-1

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems actionview >= 4.0.0, < 4.2.11.1 4.2.11.1 GHSA-m63j-wh5w-c252
RubyGems actionview >= 5.2.0, < 5.2.2.1 5.2.2.1 GHSA-m63j-wh5w-c252
RubyGems actionview >= 5.1.0, < 5.1.6.2 5.1.6.2 GHSA-m63j-wh5w-c252
RubyGems actionview >= 5.0.0, < 5.0.7.2 5.0.7.2 GHSA-m63j-wh5w-c252
RubyGems actionview >= 6.0.0.beta1, < 6.0.0.beta3 6.0.0.beta3 GHSA-m63j-wh5w-c252

Advisories 18

References