Not rated
CVE-2019-5419 There is a possible denial of service vulnerability in Action View…
Description
There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| https://github.com/rails/rails | 5.2.2.1 | No fix stated |
| https://github.com/rails/rails | 5.1.6.2 | No fix stated |
| https://github.com/rails/rails | 5.0.7.2 | No fix stated |
| https://github.com/rails/rails | 4.2.11.1 | No fix stated |
References
- [oss-security] 20190322 [CVE-2019-5418] Amendment: Possible Remote Code Execution Exploit in Action View www.openwall.com
- weblog.rubyonrails.org weblog.rubyonrails.org
- groups.google.com groups.google.com
- [debian-lts-announce] 20190331 [SECURITY] [DLA 1739-1] rails security update lists.debian.org
- RHSA-2019:0796 access.redhat.com
- openSUSE-SU-2019:1344 lists.opensuse.org
- FEDORA-2019-1cfe24db5c lists.fedoraproject.org
- RHSA-2019:1149 access.redhat.com
- RHSA-2019:1147 access.redhat.com
- RHSA-2019:1289 access.redhat.com
- openSUSE-SU-2019:1527 lists.opensuse.org
- openSUSE-SU-2019:1824 lists.opensuse.org
Timeline
- Published
- Last modified