Date: Tue, 10 Mar 2015 11:51:02 -0400 (EDT) From: cve-assign@...re.org To: mprpic@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request: Ruby on Rails ActiveModel::Name to_json Call Infinite Loop Remote DoS -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 As far as we can tell, the status of this is that: https://github.com/rubysec/ruby-advisory-db/issues/130#issuecomment-77688439 (in, more or less, the role of the upstream vendor) suggests an alternative interpretation in which this is a bug but not a vulnerability. The bug has been fixed: https://github.com/rails/rails/commit/a0580e974b4a058a983de6c593e4573bd94b76f0 As mentioned at: https://github.com/rails/rails/pull/19055#issuecomment-75798877 the bug made it possible to write code that had an unintentional infinite loop. Apparently nobody has yet mentioned an actual or realistic scenario in which the infinite looping can begin only after a manipulation of input by a client. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJU/xJiAAoJEKllVAevmvmsQe4H/iIDCXa5vM4lPC3Et3UTKooO BKV0T3cxNTLwpWNz7tYEPaRTohompQTtE0E43Wm9RWB9ODI7taWGA3rOpUbhG+LO wWQjIKkYc+ax0JD5q0tboqENnV9um0u7RqHid21diSXXACIq/37CDoGZgddScJso yw1t2ZNZeJwe4IBsrxIrkSRG6RoeOfpRt+DuET/vEuTQRJdif/zri7MJp6FMCN/n fK0jEFKb1D9WV1EPb/+e12h5SiyZHFCat6Gd5gckNXLHvhs3FfYtf5bIgV0vQR48 eOt1mAH7sh9eStvqndR+hkJHRsGRWs+o5NyWEYd+EBY3ZxOo4qJGSnnj6nZ4v6k= =QZrH -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ