Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 10 Mar 2015 11:51:02 -0400 (EDT)
From: cve-assign@...re.org
To: mprpic@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: Ruby on Rails ActiveModel::Name to_json Call Infinite Loop Remote DoS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

As far as we can tell, the status of this is that:

  https://github.com/rubysec/ruby-advisory-db/issues/130#issuecomment-77688439

(in, more or less, the role of the upstream vendor) suggests an
alternative interpretation in which this is a bug but not a
vulnerability. The bug has been fixed:

  https://github.com/rails/rails/commit/a0580e974b4a058a983de6c593e4573bd94b76f0

As mentioned at:

  https://github.com/rails/rails/pull/19055#issuecomment-75798877

the bug made it possible to write code that had an unintentional
infinite loop. Apparently nobody has yet mentioned an actual or
realistic scenario in which the infinite looping can begin only after
a manipulation of input by a client.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJU/xJiAAoJEKllVAevmvmsQe4H/iIDCXa5vM4lPC3Et3UTKooO
BKV0T3cxNTLwpWNz7tYEPaRTohompQTtE0E43Wm9RWB9ODI7taWGA3rOpUbhG+LO
wWQjIKkYc+ax0JD5q0tboqENnV9um0u7RqHid21diSXXACIq/37CDoGZgddScJso
yw1t2ZNZeJwe4IBsrxIrkSRG6RoeOfpRt+DuET/vEuTQRJdif/zri7MJp6FMCN/n
fK0jEFKb1D9WV1EPb/+e12h5SiyZHFCat6Gd5gckNXLHvhs3FfYtf5bIgV0vQR48
eOt1mAH7sh9eStvqndR+hkJHRsGRWs+o5NyWEYd+EBY3ZxOo4qJGSnnj6nZ4v6k=
=QZrH
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ