Aaron Patterson of the Ruby on Rails project reports: There is a denial of service vulnerability in the text rendering component of Action View. Versions Affected: 3.0.x, 3.1.x, 3.2.x Not affected: 4.0.x Fixed Versions: 3.2.17 Impact ------ Strings sent in specially crafted headers will be converted to symbols. This can cause a denial of service since symbols are not removed by the garbage collector. All users running an affected release should either upgrade or use one of the work arounds immediately.
Created attachment 863439 [details] 3-0-render_text_dos.patch
Created attachment 863440 [details] 3-1-render_text_dos.patch
Created attachment 863441 [details] 3-2-render_text_dos.patch
Acknowledgements: Red Hat would like to thank the Ruby on Rails Project for reporting this issue. Upstream acknowledges Toby Hsieh of SlideShare as the original reporter.
Created rubygem-actionpack tracking bugs for this issue: Affects: fedora-19 [bug 1066661]
Fixed upstream in 3.2.17: http://weblog.rubyonrails.org/2014/2/18/Rails_3_2_17_4_0_3_and_4_1_0_beta2_have_been_released/ https://groups.google.com/forum/#!topic/ruby-security-ann/ZaQ0-g1gUpc Upstream commits: https://github.com/rails/rails/commit/388d2f88886e4da8cc9fd9e14c80a4021ef47da1
rubygem-actionpack-3.2.13-5.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in following products: CloudForms Management Engine 5.x Via RHSA-2014:0215 https://rhn.redhat.com/errata/RHSA-2014-0215.html
This issue has been addressed in following products: Red Hat Software Collections for RHEL-6 Via RHSA-2014:0306 https://rhn.redhat.com/errata/RHSA-2014-0306.html
Statement: Red Hat OpenShift Enterprise 1.2 is now in Production 1 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat OpenShift Enterprise Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift.