CVE - CVE-2024-47889

CVE-ID
CVE-2024-47889	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the block_format helper in Action Mailer. Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling the `block_format` helper or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/rails/rails/commit/0e5694f4d32544532d2301a9b4084eacb6986e94 URL:https://github.com/rails/rails/commit/0e5694f4d32544532d2301a9b4084eacb6986e94 MISC:https://github.com/rails/rails/commit/3612e3eb3fbafed4f85e1c6ea4c7b6addbb0fdd3 URL:https://github.com/rails/rails/commit/3612e3eb3fbafed4f85e1c6ea4c7b6addbb0fdd3 MISC:https://github.com/rails/rails/commit/985f1923fa62806ff676e41de67c3b4552131ab9 URL:https://github.com/rails/rails/commit/985f1923fa62806ff676e41de67c3b4552131ab9 MISC:https://github.com/rails/rails/commit/be898cc996986decfe238341d96b2a6573b8fd2e URL:https://github.com/rails/rails/commit/be898cc996986decfe238341d96b2a6573b8fd2e MISC:https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6 URL:https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20241004	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20241004)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)