Vulnerability in Rubyonrails Rails

CVE-2013-4389

Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.

EPSS: 0.031 (86.5th percentile) — read the EPSS interpretation.

Affected products

Rubyonrails Rails
Debian Debian_linux — versions 7.0
Opensuse — versions 12.2, 12.3, 13.1
N/a — versions n/a

Weakness classification (CWE)

CWE-134 — Use of Externally-Controlled Format String

References

secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Exploit, Broken Link)
secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)