activesupport vulnerable to Denial of Service via large XML document depth
Moderate severity
GitHub Reviewed
Published
Oct 24, 2017
to the GitHub Advisory Database
•
Updated Jan 23, 2023
Package
Affected versions
< 4.1.11
>= 4.2.0, < 4.2.2
Patched versions
4.1.11
4.2.2
Description
Published to the GitHub Advisory Database
Oct 24, 2017
Reviewed
Jun 16, 2020
Last updated
Jan 23, 2023
The (1)
jdom.rband (2)rexml.rbcomponents in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.References