CVE-2023-22792
Summary
| CVE | CVE-2023-22792 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-02-09 20:15:00 UTC |
|---|
| Updated | 2024-02-02 14:15:00 UTC |
|---|
| Description | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately. |
|---|
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|
| Application |
Rubyonrails |
Rails |
All |
All |
All |
All |
References
| Reference | Source | Link | Tags |
|---|
| Debian -- Security Information -- DSA-5372-1 rails |
DEBIAN |
www.debian.org |
|
| [CVE-2023-22792] Possible ReDoS based DoS vulnerability in Action Dispatch - Security Announcements - Ruby on Rails Discussions |
MISC |
discuss.rubyonrails.org |
|
| CVE-2023-22792 Ruby on Rails Vulnerability in NetApp Products | NetApp Product Security |
|
security.netapp.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 181676 Debian Security Update for rails (DSA 5372-1)
- 184926 Debian Security Update for rails (CVE-2023-22792)
- 242347 Red Hat Update for Satellite 6.14 (RHSA-2023:6818)
- 284280 Fedora Security Update for rubygem (FEDORA-2023-f60cca0686)
- 753715 SUSE Enterprise Linux Security Update for rubygem-actionpack-5_1 (SUSE-SU-2023:0444-1)
- 961065 Rocky Linux Security Update for Satellite (RLSA-2023:6818)
