RubyGems/rack CVE-2011-5036: medium, EPSS 3.87%
Rack Gem Subject to Denial of Service via Hash Collisions
Action: Upgrade rack to 1.1.3 (1.1.x), 1.2.5 (1.2.x) or 1.3.6 (1.3.x) or later.
bundle update rackAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.3 | - |
| 1.2.0 | 1.2.5 | - |
| 1.3.0 | 1.3.6 | - |
Fixed versions
| 1.1.3 | 1.2.5 | 1.3.6 |
Sources
- osv: GHSA-v6j3-7jrw-hq2p
- https://nvd.nist.gov/vuln/detail/CVE-2011-5036
- https://gist.github.com/52bbc6b9cc19ce330829
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2011-5036.yml
- https://web.archive.org/web/20120201040317/http://jruby.org/2011/12/27/jruby-1-6-5-1
- https://web.archive.org/web/20130213132312/http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
- http://www.debian.org/security/2013/dsa-2783
- http://www.kb.cert.org/vuls/id/903934
- http://www.nruns.com/_downloads/advisory28122011.pdf
- http://www.ocert.org/advisories/ocert-2011-003.html
CVE-2011-5036 · published · modified · JSON