CVE - CVE-2024-47887

CVE-ID
CVE-2024-47887	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. For applications using HTTP Token authentication via `authenticate_or_request_with_http_token` or similar, a carefully crafted header may cause header parsing to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may choose to use Ruby 3.2 as a workaround.Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/rails/rails/commit/56b2fc3302836405b496e196a8d5fc0195e55049 URL:https://github.com/rails/rails/commit/56b2fc3302836405b496e196a8d5fc0195e55049 MISC:https://github.com/rails/rails/commit/7c1398854d51f9bb193fb79f226647351133d08a URL:https://github.com/rails/rails/commit/7c1398854d51f9bb193fb79f226647351133d08a MISC:https://github.com/rails/rails/commit/8e057db25bff1dc7a98e9ae72e0083825b9ac545 URL:https://github.com/rails/rails/commit/8e057db25bff1dc7a98e9ae72e0083825b9ac545 MISC:https://github.com/rails/rails/commit/f4dc83d8926509d0958ec21fcdbc2e7df3d32ce2 URL:https://github.com/rails/rails/commit/f4dc83d8926509d0958ec21fcdbc2e7df3d32ce2 MISC:https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4 URL:https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20241004	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20241004)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)