Description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. NumberToDelimitedConverter uses a lookahead-based regular expression with gsub! to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and gsub! can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 12 | | =2:6.1.7.10+dfsg-1~deb12u1 || =2:6.1.7.10+dfsg-1~deb12u2 || =2:6.1.7.3+dfsg-1 || =2:6.1.7.3+dfsg-10 || =2:6.1.7.3+dfsg-11 || =2:6.1.7.3+dfsg-12 || =2:6.1.7.3+dfsg-13 || =2:6.1.7.3+dfsg-2 || =2:6.1.7.3+dfsg-2~deb12u1 || =2:6.1.7.3+dfsg-3 || =2:6.1.7.3+dfsg-4 || =2:6.1.7.3+dfsg-5 || =2:6.1.7.3+dfsg-6 || =2:6.1.7.3+dfsg-7 || =2:6.1.7.3+dfsg-7~exp1 || =2:6.1.7.3+dfsg-8 || =2:6.1.7.3+dfsg-9 || =2:7.2.2.1+dfsg-1 || =2:7.2.2.1+dfsg-1~exp1 || =2:7.2.2.1+dfsg-1~exp2 || =2:7.2.2.1+dfsg-1~exp3 || =2:7.2.2.1+dfsg-1~exp4 || =2:7.2.2.1+dfsg-1~exp6 || =2:7.2.2.1+dfsg-2 || =2:7.2.2.1+dfsg-3 || =2:7.2.2.1+dfsg-4 || =2:7.2.2.1+dfsg-5 || =2:7.2.2.1+dfsg-6 || =2:7.2.2.1+dfsg-7 || =2:7.2.2.2+dfsg-1 || =2:7.2.2.2+dfsg-2 || =2:7.2.2.2+dfsg-2~deb13u1 || =2:7.2.3+dfsg-1 || =2:7.2.3+dfsg-2 || =2:7.2.3+dfsg-3 || =2:7.2.3.1+dfsg-1 || =2:7.2.3.2+dfsg-1 || =2:7.2.3.2+dfsg-2 | - |
debian 13 | | =2:7.2.2.1+dfsg-7 || =2:7.2.2.2+dfsg-1 || =2:7.2.2.2+dfsg-2 || =2:7.2.2.2+dfsg-2~deb13u1 || =2:7.2.3+dfsg-1 || =2:7.2.3+dfsg-2 || =2:7.2.3+dfsg-3 || =2:7.2.3.1+dfsg-1 || =2:7.2.3.2+dfsg-1 || =2:7.2.3.2+dfsg-2 | - |
debian 14 | | =2:7.2.2.1+dfsg-7 || =2:7.2.2.2+dfsg-1 || =2:7.2.2.2+dfsg-2 || =2:7.2.2.2+dfsg-2~deb13u1 || =2:7.2.3+dfsg-1 || =2:7.2.3+dfsg-2 || =2:7.2.3+dfsg-3 || >=0 <2:7.2.3.1+dfsg-1 | 2:7.2.3.1+dfsg-1 |
 rubygems | | >=8.1.0.beta1 <8.1.2.1 || >=8.0.0.beta1 <8.0.4.1 || >=0 <7.2.3.1 | 8.1.2.1, 8.0.4.1, 7.2.3.1 |
