CVE-2014-6438
Fixed in a distro release EPSS 4%
The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.
Products: ruby-lang ruby
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 6.0 | ruby1.9.1 | 1.9.2.0-2+deb6u6 |
| Red Hat hummingbird 1 | ruby3.3 | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-bundled-gems | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-default-gems | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-devel | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-doc | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-libs | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4 | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-bundled-gems | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-default-gems | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-devel | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-doc | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-libs | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby4.0 | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-bundled-gems | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-default-gems | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-devel | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-doc | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-libs | 0:4.0.0-33.3.hum1 |