Lucene search
HistoryFeb 20, 2014 - 3:27 p.m.
CVE-2014-0082
cve
ruby on rails
denial of service
vulnerability
nvd
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
6 Medium
AI Score
Confidence
High
0.029 Low
EPSS
Percentile
90.9%
actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.
Affected configurations
Node
rubyonrailsrailsMatch3.0.0
ORrubyonrailsrailsMatch3.0.0beta
ORrubyonrailsrailsMatch3.0.0beta2
ORrubyonrailsrailsMatch3.0.0beta3
ORrubyonrailsrailsMatch3.0.0beta4
ORrubyonrailsrailsMatch3.0.0rc
ORrubyonrailsrailsMatch3.0.0rc2
ORrubyonrailsrailsMatch3.0.1
ORrubyonrailsrailsMatch3.0.1pre
ORrubyonrailsrailsMatch3.0.2
ORrubyonrailsrailsMatch3.0.2pre
ORrubyonrailsrailsMatch3.0.3
ORrubyonrailsrailsMatch3.0.4rc1
ORrubyonrailsrailsMatch3.0.5
ORrubyonrailsrailsMatch3.0.5rc1
ORrubyonrailsrailsMatch3.0.6
ORrubyonrailsrailsMatch3.0.6rc1
ORrubyonrailsrailsMatch3.0.6rc2
ORrubyonrailsrailsMatch3.0.7
ORrubyonrailsrailsMatch3.0.7rc1
ORrubyonrailsrailsMatch3.0.7rc2
ORrubyonrailsrailsMatch3.0.8
ORrubyonrailsrailsMatch3.0.8rc1
ORrubyonrailsrailsMatch3.0.8rc2
ORrubyonrailsrailsMatch3.0.8rc3
ORrubyonrailsrailsMatch3.0.8rc4
ORrubyonrailsrailsMatch3.0.9
ORrubyonrailsrailsMatch3.0.9rc1
ORrubyonrailsrailsMatch3.0.9rc2
ORrubyonrailsrailsMatch3.0.9rc3
ORrubyonrailsrailsMatch3.0.9rc4
ORrubyonrailsrailsMatch3.0.9rc5
ORrubyonrailsrailsMatch3.0.10
ORrubyonrailsrailsMatch3.0.10rc1
ORrubyonrailsrailsMatch3.0.11
ORrubyonrailsrailsMatch3.0.12
ORrubyonrailsrailsMatch3.0.12rc1
ORrubyonrailsrailsMatch3.0.13
ORrubyonrailsrailsMatch3.0.13rc1
ORrubyonrailsrailsMatch3.0.14
ORrubyonrailsrailsMatch3.0.16
ORrubyonrailsrailsMatch3.0.17
ORrubyonrailsrailsMatch3.0.18
ORrubyonrailsrailsMatch3.0.19
ORrubyonrailsrailsMatch3.0.20
ORrubyonrailsrailsMatch3.1.0
ORrubyonrailsrailsMatch3.1.0beta1
ORrubyonrailsrailsMatch3.1.0rc1
ORrubyonrailsrailsMatch3.1.0rc2
ORrubyonrailsrailsMatch3.1.0rc3
ORrubyonrailsrailsMatch3.1.0rc4
ORrubyonrailsrailsMatch3.1.0rc5
ORrubyonrailsrailsMatch3.1.0rc6
ORrubyonrailsrailsMatch3.1.0rc7
ORrubyonrailsrailsMatch3.1.0rc8
ORrubyonrailsrailsMatch3.1.1
ORrubyonrailsrailsMatch3.1.1rc1
ORrubyonrailsrailsMatch3.1.1rc2
ORrubyonrailsrailsMatch3.1.1rc3
ORrubyonrailsrailsMatch3.1.2
ORrubyonrailsrailsMatch3.1.2rc1
ORrubyonrailsrailsMatch3.1.2rc2
ORrubyonrailsrailsMatch3.1.3
ORrubyonrailsrailsMatch3.1.4
ORrubyonrailsrailsMatch3.1.4rc1
ORrubyonrailsrailsMatch3.1.5
ORrubyonrailsrailsMatch3.1.5rc1
ORrubyonrailsrailsMatch3.1.6
ORrubyonrailsrailsMatch3.1.7
ORrubyonrailsrailsMatch3.1.8
ORrubyonrailsrailsMatch3.1.9
ORrubyonrailsrailsMatch3.1.10
ORrubyonrailsrailsMatch3.2.0
ORrubyonrailsrailsMatch3.2.0rc1
ORrubyonrailsrailsMatch3.2.0rc2
ORrubyonrailsrailsMatch3.2.1
ORrubyonrailsrailsMatch3.2.2
ORrubyonrailsrailsMatch3.2.2rc1
ORrubyonrailsrailsMatch3.2.3
ORrubyonrailsrailsMatch3.2.3rc1
ORrubyonrailsrailsMatch3.2.3rc2
ORrubyonrailsrailsMatch3.2.4
ORrubyonrailsrailsMatch3.2.4rc1
ORrubyonrailsrailsMatch3.2.5
ORrubyonrailsrailsMatch3.2.6
ORrubyonrailsrailsMatch3.2.7
ORrubyonrailsrailsMatch3.2.8
ORrubyonrailsrailsMatch3.2.9
ORrubyonrailsrailsMatch3.2.10
ORrubyonrailsrailsMatch3.2.11
ORrubyonrailsrailsMatch3.2.12
ORrubyonrailsrailsMatch3.2.13
ORrubyonrailsrailsMatch3.2.13rc1
ORrubyonrailsrailsMatch3.2.13rc2
ORrubyonrailsrailsMatch3.2.15
ORrubyonrailsrailsMatch3.2.15rc3
ORrubyonrailsruby_on_railsRange≤3.2.16
ORrubyonrailsruby_on_railsMatch3.0.4
ORrubyonrailsruby_on_railsMatch3.2.14
ORrubyonrailsruby_on_railsMatch3.2.14rc1
ORrubyonrailsruby_on_railsMatch3.2.14rc2
ORrubyonrailsruby_on_railsMatch3.2.15rc1
ORrubyonrailsruby_on_railsMatch3.2.15rc2
References
lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
openwall.com/lists/oss-security/2014/02/18/10
rhn.redhat.com/errata/RHSA-2014-0215.html
rhn.redhat.com/errata/RHSA-2014-0306.html
secunia.com/advisories/57376
secunia.com/advisories/57836
www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/
groups.google.com/forum/message/raw?msg=rubyonrails-security/LMxO_3_eCuc/ozGBEhKaJbIJ
puppet.com/security/cve/cve-2014-0082
Related
cvelist
cvelist
CVE-2014-0082
2014-02-20 11:00:00
debiancve
debiancve
CVE-2014-0082
2014-02-20 15:27:09
ubuntucve
ubuntucve
CVE-2014-0082
2014-02-20 00:00:00
nvd
nvd
CVE-2014-0082
2014-02-20 15:27:09
prion
prion
Code injection
2014-02-20 15:27:00
osv
osv
actionpack Improper Input Validation vulnerability
2017-10-24 18:33:36
ruby-actionpack-3.2 - security update
2014-05-16 00:00:00
github
github
actionpack Improper Input Validation vulnerability
2017-10-24 18:33:36
rubygems
rubygems
nessus
nessus
openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:0295-1)
2014-06-13 00:00:00
CentOS 6 : ruby193-rubygem-actionpack (CESA-2014:0306)
2014-03-18 00:00:00
Debian DSA-2929-1 : ruby-actionpack-3.2 - security update
2014-05-19 00:00:00
ibm
ibm
centos
centos
ruby193 security update
2014-03-17 21:55:16
redhat
redhat
(RHSA-2014:0306) Moderate: ruby193-rubygem-actionpack security update
2014-03-17 00:00:00
(RHSA-2014:0215) Critical: cfme security, bug fix, and enhancement update
2014-03-11 00:00:00
debian
debian
[SECURITY] [DSA 2929-1] ruby-actionpack-3.2 security update
2014-05-16 08:15:07
openvas
openvas
Debian Security Advisory DSA 2929-1 (ruby-actionpack-3.2 - security update)
2014-05-16 00:00:00
Debian: Security Advisory (DSA-2929-1)
2014-05-15 00:00:00
Fedora Update for rubygem-actionpack FEDORA-2014-3232
2014-03-12 00:00:00
securityvulns
securityvulns
[SECURITY] [DSA 2929-1] ruby-actionpack-3.2 security update
2014-06-14 00:00:00
veracode
veracode
Arbitrary Code Execution
2019-05-02 05:01:21
fedora
fedora
[SECURITY] Fedora 19 Update: rubygem-actionpack-3.2.13-6.fc19
2014-05-23 18:58:55
[SECURITY] Fedora 19 Update: rubygem-actionpack-3.2.13-5.fc19
2014-03-11 04:11:08
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
6 Medium
AI Score
Confidence
High
0.029 Low
EPSS
Percentile
90.9%
Related for CVE-2014-0082