[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 10 Mar 2015 11:51:02 -0400 (EDT)
From: cve-assign@...re.org
To: mprpic@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: Ruby on Rails ActiveModel::Name to_json Call Infinite Loop Remote DoS
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
As far as we can tell, the status of this is that:
https://github.com/rubysec/ruby-advisory-db/issues/130#issuecomment-77688439
(in, more or less, the role of the upstream vendor) suggests an
alternative interpretation in which this is a bug but not a
vulnerability. The bug has been fixed:
https://github.com/rails/rails/commit/a0580e974b4a058a983de6c593e4573bd94b76f0
As mentioned at:
https://github.com/rails/rails/pull/19055#issuecomment-75798877
the bug made it possible to write code that had an unintentional
infinite loop. Apparently nobody has yet mentioned an actual or
realistic scenario in which the infinite looping can begin only after
a manipulation of input by a client.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJU/xJiAAoJEKllVAevmvmsQe4H/iIDCXa5vM4lPC3Et3UTKooO
BKV0T3cxNTLwpWNz7tYEPaRTohompQTtE0E43Wm9RWB9ODI7taWGA3rOpUbhG+LO
wWQjIKkYc+ax0JD5q0tboqENnV9um0u7RqHid21diSXXACIq/37CDoGZgddScJso
yw1t2ZNZeJwe4IBsrxIrkSRG6RoeOfpRt+DuET/vEuTQRJdif/zri7MJp6FMCN/n
fK0jEFKb1D9WV1EPb/+e12h5SiyZHFCat6Gd5gckNXLHvhs3FfYtf5bIgV0vQR48
eOt1mAH7sh9eStvqndR+hkJHRsGRWs+o5NyWEYd+EBY3ZxOo4qJGSnnj6nZ4v6k=
=QZrH
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
