Vulnerability in ruby-activesupport-3.2 - Denial of Service (SystemStackError)
Summary
DLA-603-1: ruby-activesupport-3.2 - security update. Affects ruby-activesupport-3.2 versions < 3.2.6-6+deb7u2. Fixed in 3.2.6-6+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ruby-activesupport-3.2 is a package used by the Rails 3.2 framework. It provides support and utility classes for various functionalities within the framework. This package is vulnerable to a denial of service attack, specifically a SystemStackError, caused by processing large XML documents with excessive depth.
Vulnerability Detail
The vulnerability in ruby-activesupport-3.2 allows remote attackers to exploit the package's XML document processing functionality to cause a denial of service. By sending a large XML document with excessive depth, the package encounters a SystemStackError, leading to the unavailability of the affected system. This vulnerability can be exploited remotely without requiring any authentication.
How To Fix
Minimum fixed version
3.2.6-6+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby-activesupport-3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the ruby-activesupport-3.2 package to the latest version.
Conclusion
The vulnerability in ruby-activesupport-3.2 allows remote attackers to cause a denial of service by exploiting the package's XML document processing functionality. To mitigate this vulnerability, it is crucial to upgrade the package to version 3.2.6-6+deb7u2 or later. No known workarounds are available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby-activesupport-3.2 →
FAQ
The vulnerability allows remote attackers to cause a denial of service, rendering the affected system unavailable.
Yes, this vulnerability can be exploited remotely without requiring any authentication.
No, there is no known workaround for this vulnerability. Upgrading the package is the recommended solution.
All versions of ruby-activesupport-3.2 prior to 3.2.6-6+deb7u2 are affected.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for ruby-activesupport-3.2.
