CVE-2024-41128

Description

Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to version 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may use Ruby 3.2 as a workaround. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Risk Information

Base Score

3.7

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Score

Exploitation Probability

0.446

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2024-47887,CVE-2024-41128 are fixed in Ruby-actionpack 6.1.7.9	Windows
Vulnerabilities CVE-2024-47887,CVE-2024-41128 are fixed in Ruby-actionpack 7.0.8.5	Windows
Vulnerabilities CVE-2024-47887,CVE-2024-41128 are fixed in Ruby-actionpack 7.1.4.1	Windows
Vulnerabilities CVE-2024-47887,CVE-2024-41128 are fixed in Ruby-actionpack 7.2.1.1	Windows
rails security update(DSA-5881-1) rails_6.1.7.10+dfsg-1~deb12u1_all.deb	Linux
Vulnerabilities CVE-2024-47887,CVE-2024-41128 are fixed in Ruby-actionpack for Linux 6.1.7.9	Linux
Vulnerabilities CVE-2024-47887,CVE-2024-41128 are fixed in Ruby-actionpack for Linux 7.0.8.5	Linux
Vulnerabilities CVE-2024-47887,CVE-2024-41128 are fixed in Ruby-actionpack for Linux 7.1.4.1	Linux
Vulnerabilities CVE-2024-47887,CVE-2024-41128 are fixed in Ruby-actionpack for Linux 7.2.1.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234