Fluid Attacks Database

Description

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.7	ruby	>=2.2.0 <2.4.4-r0	2.4.4-r0
alpine v3.6	ruby	>=2.2.0 <2.4.4-r0	2.4.4-r0
alpine v3.13	ruby	>=2.2.0 <2.5.1-r0	2.5.1-r0
alpine v3.14	ruby	>=2.2.0 <2.5.1-r0	2.5.1-r0
alpine v3.5	ruby	>=2.2.0 <2.3.7-r0	2.3.7-r0
alpine v3.9	ruby	>=2.2.0 <2.5.1-r0	2.5.1-r0
alpine v3.11	ruby	>=2.2.0 <2.5.1-r0	2.5.1-r0
alpine v3.12	ruby	>=2.2.0 <2.5.1-r0	2.5.1-r0
alpine v3.15	ruby	>=2.2.0 <2.5.1-r0	2.5.1-r0
alpine v3.16	ruby	>=2.2.0 <2.5.1-r0	2.5.1-r0

1-10 of 27

References

1. http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html2. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/3. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/4. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/5. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.