Vulnerability in Rubyonrails Rails
CVE-2015-3227
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
EPSS: 0.043 (90.0th percentile) — read the EPSS interpretation.
Affected products
- Rubyonrails Rails — versions 4.1.0, 4.1.1, 4.1.2
- Opensuse — versions 13.1, 13.2
- N/a — versions n/a
Public proof-of-concept exploits
References
- secalert@redhat.com (vdb-entry, x_refsource_SECTRACK)
- secalert@redhat.com (vdb-entry, x_refsource_BID)
- secalert@redhat.com (Vendor Advisory, mailing-list, x_refsource_MLIST)
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
- secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2015-3227?
- CVE-2015-3227 is a vulnerability in Rubyonrails Rails. Published 2015-07-26.
- Is CVE-2015-3227 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.