CVE-2015-3227 (Medium) detected in activesupport-4.1.0.gem

[mend-for-github-com]

CVE-2015-3227 - Medium Severity Vulnerability

Vulnerable Library - activesupport-4.1.0.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Library home page: https://rubygems.org/gems/activesupport-4.1.0.gem

Dependency Hierarchy:

• rails-4.1.0.gem (Root Library)
  • actionmailer-4.1.0.gem
    • actionview-4.1.0.gem
      • ❌ activesupport-4.1.0.gem (Vulnerable Library)

Found in HEAD commit: 5a413d9b2f9c78839525a25524a6091e2a91db92

Found in base branch: master

Vulnerability Details

The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.

Publish Date: 2015-07-26

URL: CVE-2015-3227

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-3227

Release Date: 2015-07-26

Fix Resolution: 4.1.11,4.2.2