Bug 1065538 (CVE-2014-0082)
| Summary: | CVE-2014-0082 rubygem-actionpack: Action View string handling denial of service | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Kurt Seifried <kseifried> | ||||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | unspecified | CC: | apevec, athomas, ayoung, bdunne, bkearney, bleanhar, ccoleman, chrisw, cpelland, dajohnso, dmcphers, drieden, gkotton, hhorak, jfrey, jialiu, jrafanie, lhh, lmeyer, markmc, mmaslano, mmccune, mmcgrath, mpovolny, nobody+bgollahe, obarenbo, rbryant, sclewis, security-response-team, srevivo, tdawson, vondruch, xlecauch | ||||||||
| Target Milestone: | --- | Keywords: | Security | ||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | rubygem-actionpack 3.2.17 | Doc Type: | Bug Fix | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2019-06-08 02:31:41 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | 1065588, 1065589, 1065590, 1065591, 1065592, 1065593, 1065891, 1066661, 1165379 | ||||||||||
| Bug Blocks: | 1065543 | ||||||||||
| Attachments: |
|
||||||||||
|
Description
Kurt Seifried
2014-02-14 21:36:24 UTC
Created attachment 863439 [details]
3-0-render_text_dos.patch
Created attachment 863440 [details]
3-1-render_text_dos.patch
Created attachment 863441 [details]
3-2-render_text_dos.patch
Acknowledgements: Red Hat would like to thank the Ruby on Rails Project for reporting this issue. Upstream acknowledges Toby Hsieh of SlideShare as the original reporter. Created rubygem-actionpack tracking bugs for this issue: Affects: fedora-19 [bug 1066661] Fixed upstream in 3.2.17: http://weblog.rubyonrails.org/2014/2/18/Rails_3_2_17_4_0_3_and_4_1_0_beta2_have_been_released/ https://groups.google.com/forum/#!topic/ruby-security-ann/ZaQ0-g1gUpc Upstream commits: https://github.com/rails/rails/commit/388d2f88886e4da8cc9fd9e14c80a4021ef47da1 rubygem-actionpack-3.2.13-5.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in following products: CloudForms Management Engine 5.x Via RHSA-2014:0215 https://rhn.redhat.com/errata/RHSA-2014-0215.html This issue has been addressed in following products: Red Hat Software Collections for RHEL-6 Via RHSA-2014:0306 https://rhn.redhat.com/errata/RHSA-2014-0306.html Statement: Red Hat OpenShift Enterprise 1.2 is now in Production 1 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat OpenShift Enterprise Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift. |