CVE-2015-3227 (Medium) detected in activesupport-4.1.0.gem

[mend-bolt-for-github]

CVE-2015-3227 - Medium Severity Vulnerability

Vulnerable Library - activesupport-4.1.0.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Library home page: https://rubygems.org/gems/activesupport-4.1.0.gem

Path to dependency file: /tmp/ws-scm/app1/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/activesupport-4.1.0.gem

Dependency Hierarchy:

• sass-rails-4.0.3.gem (Root Library)
  • railties-4.1.0.gem
    • ❌ activesupport-4.1.0.gem (Vulnerable Library)

Found in HEAD commit: 9d946faa10e3050193fb56220287f7565773de83

Vulnerability Details

The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.

Publish Date: 2015-07-26

URL: CVE-2015-3227

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-3227

Release Date: 2015-07-26

Fix Resolution: 4.1.11,4.2.2