VulnerabilityModified
CVE-2015-3227
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
MEDIUM 5.0EPSS 4.26%
Does this matter?
Lower severity and a low EPSS score (4.26%). Track it; it rarely justifies an emergency change on its own.
Description
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 4.26% probability · 91th percentile
- CISA KEV
- Not listed
- Affected
- opensuse/opensuse · rubyonrails/rails
- Source
- secalert@redhat.com
References
- http://lists.opensuse.org/opensuse-updates/2015-07/msg00050.html
- http://openwall.com/lists/oss-security/2015/06/16/16
- http://www.debian.org/security/2016/dsa-3464
- http://www.securityfocus.com/bid/75234
- http://www.securitytracker.com/id/1033755
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8JVendor Advisory
- http://lists.opensuse.org/opensuse-updates/2015-07/msg00050.html
- http://openwall.com/lists/oss-security/2015/06/16/16
- http://www.debian.org/security/2016/dsa-3464
- http://www.securityfocus.com/bid/75234
- http://www.securitytracker.com/id/1033755
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8JVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.