Description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. 1e10000), which BigDecimal expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 rubygems | | >=8.1.0.beta1 <8.1.2.1 || >=8.0.0.beta1 <8.0.4.1 || >=0 <7.2.3.1 | 8.1.2.1, 8.0.4.1, 7.2.3.1 |
 debian 12 | | =2:6.1.7.10+dfsg-1~deb12u1 || =2:6.1.7.10+dfsg-1~deb12u2 || =2:6.1.7.3+dfsg-1 || =2:6.1.7.3+dfsg-10 || =2:6.1.7.3+dfsg-11 || =2:6.1.7.3+dfsg-12 || =2:6.1.7.3+dfsg-13 || =2:6.1.7.3+dfsg-2 || =2:6.1.7.3+dfsg-2~deb12u1 || =2:6.1.7.3+dfsg-3 || =2:6.1.7.3+dfsg-4 || =2:6.1.7.3+dfsg-5 || =2:6.1.7.3+dfsg-6 || =2:6.1.7.3+dfsg-7 || =2:6.1.7.3+dfsg-7~exp1 || =2:6.1.7.3+dfsg-8 || =2:6.1.7.3+dfsg-9 || =2:7.2.2.1+dfsg-1 || =2:7.2.2.1+dfsg-1~exp1 || =2:7.2.2.1+dfsg-1~exp2 || =2:7.2.2.1+dfsg-1~exp3 || =2:7.2.2.1+dfsg-1~exp4 || =2:7.2.2.1+dfsg-1~exp6 || =2:7.2.2.1+dfsg-2 || =2:7.2.2.1+dfsg-3 || =2:7.2.2.1+dfsg-4 || =2:7.2.2.1+dfsg-5 || =2:7.2.2.1+dfsg-6 || =2:7.2.2.1+dfsg-7 || =2:7.2.2.2+dfsg-1 || =2:7.2.2.2+dfsg-2 || =2:7.2.2.2+dfsg-2~deb13u1 || =2:7.2.3+dfsg-1 || =2:7.2.3+dfsg-2 || =2:7.2.3+dfsg-3 || =2:7.2.3.1+dfsg-1 || =2:7.2.3.2+dfsg-1 || =2:7.2.3.2+dfsg-2 | - |
debian 13 | | =2:7.2.2.1+dfsg-7 || =2:7.2.2.2+dfsg-1 || =2:7.2.2.2+dfsg-2 || =2:7.2.2.2+dfsg-2~deb13u1 || =2:7.2.3+dfsg-1 || =2:7.2.3+dfsg-2 || =2:7.2.3+dfsg-3 || =2:7.2.3.1+dfsg-1 || =2:7.2.3.2+dfsg-1 || =2:7.2.3.2+dfsg-2 | - |
debian 14 | | =2:7.2.2.1+dfsg-7 || =2:7.2.2.2+dfsg-1 || =2:7.2.2.2+dfsg-2 || =2:7.2.2.2+dfsg-2~deb13u1 || =2:7.2.3+dfsg-1 || =2:7.2.3+dfsg-2 || =2:7.2.3+dfsg-3 || >=0 <2:7.2.3.1+dfsg-1 | 2:7.2.3.1+dfsg-1 |
