Skip to content
OpenAdvisories
Medium · 6.6 CVE-2024-47889 BIT-rails-2024-47889EUVD-2024-3051GHSA-h47h-mwp9-c6q6

Action Mailer has possible ReDoS vulnerability in block_format

Published Oct 16, 2024 · Updated Oct 17, 2024 · Assigned by GitHub_M

Description

Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the block_format helper in Action Mailer. Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling the `block_format` helper or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected.

Affected products

VendorProductAffectedFixed
rails rails >= 3.0.0, < 6.1.7.9, >= 7.0.0, < 7.0.8.5, >= 7.1.0, < 7.1.4.1, >= 7.2.0, < 7.2.1.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rails 2:7.2.2.1+dfsg-1 —
Debian 13 rails 2:7.2.2.1+dfsg-1 —
Debian 12 rails 2:6.1.7.10+dfsg-1~deb12u1 DSA-5881-1
Debian 11 rails 2:6.0.3.7+dfsg-2+deb11u3 DLA-4383-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rails No fix yet —
Ubuntu 26.04 LTS rails No fix yet —
Ubuntu 25.10 rails No fix yet —
Ubuntu 24.04 LTS rails No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS rails 2:6.1.4.1+dfsg-8ubuntu2+esm1 USN-7290-1
Ubuntu Pro 20.04 LTS rails 2:5.2.3+dfsg-3ubuntu0.1~esm1 USN-7290-1
Ubuntu Pro 18.04 LTS rails 2:4.2.10-0ubuntu4+esm1 USN-7290-1
Ubuntu Pro 16.04 LTS rails 2:4.2.6-1ubuntu0.1~esm1 USN-7290-1
ReleasePackageFixed inAdvisory
SLES 15 SP5 rubygem-actionmailer-5_1 5.1.4-150000.3.3.1 SUSE-SU-2024:3878-1
SLES 15 SP4 rubygem-actionmailer-5_1 5.1.4-150000.3.3.1 SUSE-SU-2024:3878-1
SLES 15 SP3 rubygem-actionmailer-5_1 5.1.4-150000.3.3.1 SUSE-SU-2024:3878-1
SLES 15 SP2 rubygem-actionmailer-5_1 5.1.4-150000.3.3.1 SUSE-SU-2024:3878-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rubygem-rails-7.0 +1 7.0.8.6-1.1 openSUSE-SU-2025:15124-1, openSUSE-SU-2025:15109-1, openSUSE-SU-2024:14479-1

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems actionmailer >= 3.0.0, < 6.1.7.9 6.1.7.9 GHSA-h47h-mwp9-c6q6
RubyGems actionmailer >= 7.0.0, < 7.0.8.5 7.0.8.5 GHSA-h47h-mwp9-c6q6
RubyGems actionmailer >= 7.1.0, < 7.1.4.1 7.1.4.1 GHSA-h47h-mwp9-c6q6
RubyGems actionmailer >= 7.2.0, < 7.2.1.1 7.2.1.1 GHSA-h47h-mwp9-c6q6

Advisories 9

References