CVE-2024-26142

HIGH7.5EPSS 3.5%

Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch

發布日:2024/2/27修改日:2025/5/20

描述

Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.

受影響套件(2)

Bitnami/rails>= 7.1.0, < 7.1.4
RubyGems/actionpack>= 7.1.0, < 7.1.3.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-26142
PATCHhttps://github.com/rails/rails
WEBhttps://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946
WEBhttps://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272
WEBhttps://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq
WEBhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml
WEBhttps://security.netapp.com/advisory/ntap-20240503-0003/