logo

Database

Lack of data validation In actionpack

Description

actionpack Improper Input Validation vulnerability actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2013-64142. NVD-2013-64143. OSV-2013-64144. GCVE-2013-6414

References

1. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6414.yml2. https://groups.google.com/forum/#!topic/ruby-security-ann/A-ebV4WxzKg3. https://groups.google.com/forum/message/raw?msg=ruby-security-ann/A-ebV4WxzKg/KNPTbX8XAQUJ4. https://puppet.com/security/cve/cve-2013-64145. https://web.archive.org/web/20160808161629/https://puppet.com/security/cve/cve-2013-64146. http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html7. http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html8. http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html9. http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html10. http://rhn.redhat.com/errata/RHSA-2013-1794.html11. http://rhn.redhat.com/errata/RHSA-2014-0008.html12. http://rhn.redhat.com/errata/RHSA-2014-1863.html13. http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released14. http://www.debian.org/security/2014/dsa-288815. http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release16. http://seclists.org/oss-sec/2013/q4/400

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.