CVE-2015-3227
1 advisory.
RubyGems/activesupport CVE-2015-3227: medium
activesupport vulnerable to Denial of Service via large XML document depth
Action: Upgrade activesupport to 3.2.22 or later.
bundle update activesupportAffected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0.beta1 | 4.1.11 | - |
| 4.2.0.beta1 | 4.2.2 | - |
| 0 | 3.2.22 | - |
Fixed versions
| 4.1.11 | 4.2.2 | 3.2.22 |
Sources
- osv: GHSA-j96r-xvjq-r9pg
- https://nvd.nist.gov/vuln/detail/CVE-2015-3227
- https://github.com/rails/rails/commit/12f763ce1131d29d24bd0d8f868e2697a139aea3
- https://github.com/rails/rails/commit/153cc843ad95930b00b0ca91d30b599b7dec9680
- https://github.com/rails/rails/commit/78b29e08c700d889837af6c51c7debd3864abc3d
- https://github.com/rails/rails
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J
- https://web.archive.org/web/20200228041703/http://www.securityfocus.com/bid/75234
- https://web.archive.org/web/20200517005133/http://www.securitytracker.com/id/1033755
- http://lists.opensuse.org/opensuse-updates/2015-07/msg00050.html
- http://openwall.com/lists/oss-security/2015/06/16/16
- http://www.debian.org/security/2016/dsa-3464
CVE-2015-3227 · published · modified · JSON