~ / search / GHSA-j96r-xvjq-r9pg

GHSA-j96r-xvjq-r9pg

activesupport vulnerable to Denial of Service via large XML document depth

Source: GitHub Advisory Database (reviewed) Moderate CVE-2015-3227

Packages

EcosystemPackageAffectedFixed in
RubyGems activesupport >= 4.0.0.beta1, < 4.1.11 4.1.11
RubyGems activesupport >= 4.2.0.beta1, < 4.2.2 4.2.2
RubyGems activesupport < 3.2.22 3.2.22

Details

As written in the advisory (Markdown source, shown as plain text).

The (1) `jdom.rb` and (2) `rexml.rb` components in Active Support in Ruby on Rails before 3.2.22, 4.1.x before 4.1.11, and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.

References

External links from the advisory. They lead to third-party sites.