Ruby CVE-2014-6438 Denial of Service Vulnerability
BID:100850
Info
Ruby CVE-2014-6438 Denial of Service Vulnerability
| Bugtraq ID: | 100850 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-6438 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 19 2014 12:00AM |
| Updated: | Aug 19 2014 12:00AM |
| Credit: | zzak and hone |
| Vulnerable: |
Ruby-Lang Ruby 1.9 Ruby-Lang Ruby 1.8.7 p72 Ruby-Lang Ruby 1.8.7 p71 Ruby-Lang Ruby 1.8.5 Ruby-Lang Ruby 1.9.2 Ruby-Lang Ruby 1.9.1 Ruby-Lang Ruby 1.8.7 Preview4 Ruby-Lang Ruby 1.8.7 Preview3 Ruby-Lang Ruby 1.8.7 Preview2 Ruby-Lang Ruby 1.8.7 Preview1 Ruby-Lang Ruby 1.8.7 P374 Ruby-Lang Ruby 1.8.7 P373 Ruby-Lang Ruby 1.8.7 P371 Ruby-Lang Ruby 1.8.7 P370 Ruby-Lang Ruby 1.8.7 P358 Ruby-Lang Ruby 1.8.7 P357 Ruby-Lang Ruby 1.8.7 P352 Ruby-Lang Ruby 1.8.7 P334 Ruby-Lang Ruby 1.8.7 P330 Ruby-Lang Ruby 1.8.7 P302 Ruby-Lang Ruby 1.8.7 P301 Ruby-Lang Ruby 1.8.7 P299 Ruby-Lang Ruby 1.8.7 P249 Ruby-Lang Ruby 1.8.7 P248 Ruby-Lang Ruby 1.8.7 P22 Ruby-Lang Ruby 1.8.7 P174 Ruby-Lang Ruby 1.8.7 P173 Ruby-Lang Ruby 1.8.7 P17 Ruby-Lang Ruby 1.8.7 P160 Ruby-Lang Ruby 1.8.7 Ruby-Lang Ruby 1.8.6-26 Redhat Enterprise Linux 6 Redhat Enterprise Linux 5 |
| Not Vulnerable: |
Ruby-Lang Ruby 1.9.2-p330 |
Discussion
Ruby CVE-2014-6438 Denial of Service Vulnerability
Ruby is prone to a denial-of-service vulnerability.
Attackers can exploit this issue to crash or cause the application to consume excessive resources which may cause denial-of-service conditions.
Versions prior to Ruby 1.9.2-p330 are vulnerable.
Ruby is prone to a denial-of-service vulnerability.
Attackers can exploit this issue to crash or cause the application to consume excessive resources which may cause denial-of-service conditions.
Versions prior to Ruby 1.9.2-p330 are vulnerable.
Exploit / POC
Ruby CVE-2014-6438 Denial of Service Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Ruby CVE-2014-6438 Denial of Service Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Ruby CVE-2014-6438 Denial of Service Vulnerability
References:
References:
- Bug 1490845 - (CVE-2014-6438) CVE-2014-6438 ruby: Unsafe parsing of long strings (Red Hat)
- CVE-2014-6438 (Red Hat)
- Mention the CVE id in "Ruby 1.9.2-p330 Released" #817 (Github)
- Ruby 1.9.2-p330 Released (Ruby)
- Ruby-Lang Homepage (Ruby-Lang)