Описание
In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the creation time of Bits and Integers.
Ссылки
- Third Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- ExploitPatchThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- ExploitPatchThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
EPSS
3.7 Low
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the creation time of Bits and Integers.
In the bindata RubyGem before version 2.4.10 there is a potential deni ...
Уязвимость декларативного способа чтения и записи бинарных форматов файлов BinData, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
3.7 Low
CVSS3
4.3 Medium
CVSS2