CVE-2024-41128
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-41128
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-41128.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-41128
- Aliases
- Related
- Published
- 2024-10-16T18:15:06Z
- Modified
- 2024-10-22T12:42:06.403968Z
- Summary
- [none]
- Details
-
Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to version 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may use Ruby 3.2 as a workaround. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.
- References
-
- https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
- https://github.com/rails/rails/commit/27121e80f6dbb260f5a9f0452cd8411cb681f075
- https://github.com/rails/rails/commit/b0fe99fa854ec8ff4498e75779b458392d1560ef
- https://github.com/rails/rails/commit/b1241f468d1b32235f438c2e2203386e6efd3891
- https://github.com/rails/rails/commit/fb493bebae1a9b83e494fe7edbf01f6167d606fd
- https://bugzilla.redhat.com/show_bug.cgi?id=2319036
- https://access.redhat.com/security/cve/cve-2024-41128
- https://security-tracker.debian.org/tracker/CVE-2024-41128
Affected packages
Debian:11 / rails
Package
- Name
- rails
- Purl
- pkg:deb/debian/rails?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
2:6.*
2:6.0.3.7+dfsg-2
2:6.0.3.7+dfsg-2+deb11u1
2:6.0.3.7+dfsg-2+deb11u2
2:6.0.3.7+dfsg-3
2:6.1.4+dfsg-1
2:6.1.4+dfsg-2
2:6.1.4+dfsg-3
2:6.1.4+dfsg-4
2:6.1.4.1+dfsg-1
2:6.1.4.1+dfsg-2
2:6.1.4.1+dfsg-3
2:6.1.4.1+dfsg-4
2:6.1.4.1+dfsg-5
2:6.1.4.1+dfsg-6
2:6.1.4.1+dfsg-7
2:6.1.4.1+dfsg-8
2:6.1.4.6+dfsg-1
2:6.1.4.6+dfsg-2
2:6.1.4.6+dfsg-3
2:6.1.4.7+dfsg-1
2:6.1.4.7+dfsg-2
2:6.1.6.1+dfsg-1
2:6.1.6.1+dfsg-2
2:6.1.6.1+dfsg-3
2:6.1.6.1+dfsg-4
2:6.1.7+dfsg-1
2:6.1.7+dfsg-2
2:6.1.7+dfsg-3~bpo11+1
2:6.1.7+dfsg-3~bpo11+2
2:6.1.7+dfsg-3
2:6.1.7.3+dfsg-1~bpo11+1
2:6.1.7.3+dfsg-1
2:6.1.7.3+dfsg-2~deb12u1
2:6.1.7.3+dfsg-2
2:6.1.7.3+dfsg-3
2:6.1.7.3+dfsg-4
Debian:12 / rails
Package
- Name
- rails
- Purl
- pkg:deb/debian/rails?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Debian:13 / rails
Package
- Name
- rails
- Purl
- pkg:deb/debian/rails?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Git / github.com/rails/rails
Affected ranges
- Type
- GIT
- Repo
- https://github.com/rails/rails
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixedFixed
Affected versions
Other
test-tag-1
v0.*
v0.10.0
v0.10.1
v0.11.0
v0.11.1
v0.12.0
v0.13.0
v0.13.1
v0.14.1
v0.14.3
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.4.1
v0.9.5
v1.*
v1.1.0
v1.1.0_RC1
v1.1.1
v2.*
v2.0.0
v2.0.0_PR
v2.0.0_RC1
v2.0.0_RC2
v2.0.1
v2.1.0
v2.1.0_RC1
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.2.1
v3.*
v3.0.0.beta.2
v3.0.0.beta.3
v3.0.0.beta1
v3.0.0.beta2
v3.0.0.beta3
v3.0.0.beta4
v3.0.0_RC
v3.1.0.beta1
v3.1.0.rc1
v3.2.0.rc1
v4.*
v4.0.0.beta1
v4.0.0.rc1
v4.1.0.beta1
v4.1.0.beta2
v4.2.0.beta1
v4.2.0.beta4
v5.*
v5.0.0.beta1
v5.0.0.beta1.1
v5.0.0.beta2
v5.0.0.beta3
v5.0.0.beta4
v5.0.0.rc1
v5.1.0.beta1
v6.*
v6.0.0.beta1
v6.0.0.beta2
v6.0.0.beta3
v6.1.0
v6.1.0.rc1
v6.1.0.rc2
v6.1.1
v6.1.2
v6.1.2.1
v6.1.3
v6.1.3.1
v6.1.3.2
v6.1.4
v6.1.4.1
v6.1.4.2
v6.1.4.3
v6.1.4.4
v6.1.4.5
v6.1.4.6
v6.1.4.7
v6.1.5
v6.1.5.1
v6.1.6
v6.1.6.1
v6.1.7
v6.1.7.1
v6.1.7.2
v6.1.7.3
v6.1.7.4
v6.1.7.5
v6.1.7.6
v6.1.7.7
v6.1.7.8
v7.*
v7.0.0
v7.0.0.alpha1
v7.0.0.alpha2
v7.0.0.rc1
v7.0.0.rc2
v7.0.0.rc3
v7.0.1
v7.0.2
v7.0.2.1
v7.0.2.2
v7.0.2.3
v7.0.2.4
v7.0.3
v7.0.3.1
v7.0.4
v7.0.4.1
v7.0.4.2
v7.0.4.3
v7.0.5
v7.0.5.1
v7.0.6
v7.0.7
v7.0.7.1
v7.0.7.2
v7.0.8
v7.0.8.1
v7.0.8.2
v7.0.8.3
v7.0.8.4
v7.1.0
v7.1.0.beta1
v7.1.0.rc1
v7.1.0.rc2
v7.1.1
v7.1.2
v7.1.3
v7.1.3.1
v7.1.3.2
v7.1.3.3
v7.1.3.4
v7.1.4
v7.2.0
v7.2.0.beta1
v7.2.0.beta2
v7.2.0.beta3
v7.2.0.rc1
v7.2.1