Vulnerability in Ruby-Lang Ruby
CVE-2009-1904
The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.128 (96.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.084 · newest: 0.128 · change: +0.044
Affected products
- Ruby-Lang Ruby — versions 1.8.6, 1.8.7
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.vupen.com/english/advisories/2009/1563 (vdb-entry)
- secunia.com/advisories/35937 (third-party-advisory)
- secunia.com/advisories/35593 (third-party-advisory)
- www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/ (Patch, Vendor Advisory)
- redmine.ruby-lang.org/issues/show/794 (Exploit, Patch)
- bugs.launchpad.net/bugs/cve/2009-1904
- bugs.debian.org/cgi-bin/bugreport.cgi (Patch)
- www.redhat.com/support/errata/RHSA-2009-1140.html (vendor-advisory)
- mail-index.netbsd.org/pkgsrc-changes/2009/06/10/msg024708.html (mailing-list)
- groups.google.com/group/rubyonrails-security/msg/fad60751e2b9b4f6 (mailing-list)
Frequently asked questions
- What is CVE-2009-1904?
- CVE-2009-1904 is a vulnerability in Ruby-Lang Ruby, classified under CWE-189. Published 2009-06-11.
- Is CVE-2009-1904 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.