HIGH

GHSA-9wrq-xvmp-xjc8

Rails Denial of Service vulnerability

Quick fix

GHSA-9wrq-xvmp-xjc8 — rails: upgrade to the fixed version with the command below.

bundle update rails

Details

Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or "data loss," a different vulnerability than CVE-2006-4111.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/rails

Introduced in: 1.1.0Fixed in: 1.1.6

Fixbundle update rails

References

https://nvd.nist.gov/vuln/detail/CVE-2006-4112[ADVISORY]
https://exchange.xforce.ibmcloud.com/vulnerabilities/28364[WEB]
https://github.com/rails/rails[PACKAGE]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2006-4112.yml[WEB]
https://web.archive.org/web/20200301174340/http://www.securityfocus.com/bid/19454[WEB]
https://web.archive.org/web/20200804225700/http://www.securityfocus.com/archive/1/442934/100/0/threaded[WEB]
https://web.archive.org/web/20200808083046/http://securitytracker.com/id?1016673[WEB]
http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure[WEB]
http://www.gentoo.org/security/en/glsa/glsa-200608-20.xml[WEB]
http://www.kb.cert.org/vuls/id/699540[WEB]
http://www.novell.com/linux/security/advisories/2006_21_sr.html[WEB]