CVE-2019-5419

Опубликовано: 27 мар. 2019

Источник: nvd

CVSS3: 7.5

CVSS2: 7.8

EPSS Средний

Описание

There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/03/22/1
Exploit
Mailing List
Mitigation
Patch
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0796
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1147
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1149
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1289
Third Party Advisory
https://groups.google.com/forum/#%21topic/rubyonrails-security/GN7w9fFAQeI
https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
Patch
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/03/22/1
Exploit
Mailing List
Mitigation
Patch
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0796
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1147
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1149
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1289
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*

Версия до 4.2.11.1 (исключая)

cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*

Версия от 5.0.0 (включая) до 5.0.7.2 (исключая)

cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*

Версия от 5.1.0 (включая) до 5.1.6.2 (исключая)

cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*

Версия от 5.2.0 (включая) до 5.2.2.1 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*

cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*

cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 5

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.12288

Средний

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-400

CWE-770

Связанные уязвимости

CVE-2019-5419

CVSS3: 7.5

ubuntu

почти 7 лет назад

CVE-2019-5419

CVSS3: 5.9

redhat

почти 7 лет назад

CVE-2019-5419

CVSS3: 7.5

debian

почти 7 лет назад

There is a possible denial of service vulnerability in Action View (Ra ...

GHSA-m63j-wh5w-c252

CVSS3: 7.5

github

почти 7 лет назад

Denial of Service Vulnerability in Action View

BDU:2019-01507

CVSS3: 7.5

fstec

почти 7 лет назад

Уязвимость компонента Action View программной платформы Ruby on Rails, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 94%

0.12288

Средний

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-400

CWE-770