Skip to content
OpenAdvisories
Medium · 6.6 CVE-2024-47887 BIT-rails-2024-47887EUVD-2024-3142GHSA-vfg9-r3fq-jvx4

Action Controller has possible ReDoS vulnerability in HTTP Token authentication

Published Oct 16, 2024 · Updated Oct 17, 2024 · Assigned by GitHub_M

Description

Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. For applications using HTTP Token authentication via `authenticate_or_request_with_http_token` or similar, a carefully crafted header may cause header parsing to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may choose to use Ruby 3.2 as a workaround.Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Affected products

VendorProductAffectedFixed
rails rails >= 4.0.0, < 6.1.7.9, >= 7.0.0, < 7.0.8.5, >= 7.1.0, < 7.1.4.1, >= 7.2.0, < 7.2.1.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rails 2:7.2.2.1+dfsg-1 —
Debian 13 rails 2:7.2.2.1+dfsg-1 —
Debian 12 rails 2:6.1.7.10+dfsg-1~deb12u1 DSA-5881-1
Debian 11 rails 2:6.0.3.7+dfsg-2+deb11u3 DLA-4383-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rails No fix yet —
Ubuntu 26.04 LTS rails No fix yet —
Ubuntu 25.10 rails No fix yet —
Ubuntu 24.04 LTS rails No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS rails 2:6.1.4.1+dfsg-8ubuntu2+esm1 USN-7290-1
Ubuntu Pro 20.04 LTS rails 2:5.2.3+dfsg-3ubuntu0.1~esm1 USN-7290-1
Ubuntu Pro 18.04 LTS rails 2:4.2.10-0ubuntu4+esm1 USN-7290-1
Ubuntu Pro 16.04 LTS rails 2:4.2.6-1ubuntu0.1~esm1 USN-7290-1
ReleasePackageFixed inAdvisory
SLES 15 SP6 rubygem-actionpack-5_1 5.1.4-150000.3.32.1 SUSE-SU-2024:3877-1
SLES 15 SP5 rubygem-actionpack-5_1 5.1.4-150000.3.32.1 SUSE-SU-2024:3877-1
SLES 15 SP4 rubygem-actionpack-5_1 5.1.4-150000.3.32.1 SUSE-SU-2024:3877-1
SLES 15 SP3 rubygem-actionpack-5_1 5.1.4-150000.3.32.1 SUSE-SU-2024:3877-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rubygem-rails-7.0 +1 7.0.8.6-1.1 openSUSE-SU-2025:15124-1, openSUSE-SU-2025:15110-1, openSUSE-SU-2024:14479-1

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems actionpack >= 4.0.0, < 6.1.7.9 6.1.7.9 GHSA-vfg9-r3fq-jvx4
RubyGems actionpack >= 7.0.0, < 7.0.8.5 7.0.8.5 GHSA-vfg9-r3fq-jvx4
RubyGems actionpack >= 7.1.0, < 7.1.4.1 7.1.4.1 GHSA-vfg9-r3fq-jvx4
RubyGems actionpack >= 7.2.0, < 7.2.1.1 7.2.1.1 GHSA-vfg9-r3fq-jvx4

Advisories 9

References