CVE-2016-0751

Опубликовано: 16 фев. 2016

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.5:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.6:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.6:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.6:rc2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.6:rc3:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.7:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.8:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.9:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.10:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.0.10:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.0:-:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.2:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.2:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.2:rc2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.2:rc3:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.3:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.4:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.5:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.6:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.7:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.8:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.9:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.10:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.12:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.1.13:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*

Версия до 3.2.22 (включая)

cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.10:rc2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.12:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:rc1:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.11:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.06145

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-399

Связанные уязвимости

CVE-2016-0751

CVSS3: 7.5

ubuntu

почти 10 лет назад

CVE-2016-0751

redhat

около 10 лет назад

CVE-2016-0751

CVSS3: 7.5

debian

почти 10 лет назад

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Rub ...

GHSA-ffpv-c4hm-3x6v

CVSS3: 7.5

github

больше 8 лет назад

actionpack is vulnerable to denial of service via a crafted HTTP Accept header

BDU:2016-00811

fstec

почти 10 лет назад

Уязвимость программной платформы Ruby on Rails, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 91%

0.06145

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-399