Bug 138362 - CAN-2004-0983 Denial of Service in Ruby
Summary: CAN-2004-0983 Denial of Service in Ruby
Alias: None
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: ruby   
(Show other bugs)
Version: 3.0
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Akira TAGOH
QA Contact: Bill Huang
Whiteboard: impact=moderate,public=20041103
Keywords: Security
Depends On:
TreeView+ depends on / blocked
Reported: 2004-11-08 16:26 UTC by Josh Bressers
Modified: 2007-11-30 22:07 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2004-12-13 18:53:55 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Patch from upstream to fix this issue. (1.01 KB, patch)
2004-11-08 16:52 UTC, Josh Bressers
no flags Details | Diff

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2004:635 normal SHIPPED_LIVE Moderate: ruby security update 2005-01-17 05:00:00 UTC

Description Josh Bressers 2004-11-08 16:26:35 UTC
Upstream has fixed a denial of service issue in ruby.  The CGI module
could enter into an infinite loop if a specially crafted request is
sent to it.

This issue also affects RHEL2.1

Comment 1 Josh Bressers 2004-11-08 16:52:45 UTC
Created attachment 106289 [details]
Patch from upstream to fix this issue.

Comment 2 Akira TAGOH 2004-11-09 07:47:18 UTC
Thanks for letting me know. I'll work on this.

Comment 3 Akira TAGOH 2004-11-10 07:25:04 UTC
this issue should be fixed in 1.6.8-9.EL3.3 for RHEL3 and
1.6.4-2.AS21.1 for AS2.1

Comment 4 Mark J. Cox 2004-12-13 18:53:55 UTC
An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.