CVE-2014-6438

EUVD-2014-6318
The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
Affected Products (NVD)
VendorProductVersion
ruby-langruby
𝑥
≤ 1.9.2
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby1.8
precise
ignored
trusty
dne
utopic
dne
vivid
dne
wily
dne
xenial
dne
yakkety
dne
zesty
dne
ruby1.9
maverick
dne
precise
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
xenial
dne
yakkety
dne
zesty
dne
ruby1.9.1
precise
not-affected
trusty
dne
utopic
not-affected
vivid
not-affected
wily
dne
xenial
dne
yakkety
dne
zesty
dne
ruby2.0
precise
dne
trusty
dne
utopic
not-affected
vivid
dne
wily
dne
xenial
dne
yakkety
dne
zesty
dne
ruby2.1
precise
dne
trusty
dne
utopic
not-affected
vivid
not-affected
wily
not-affected
xenial
dne
yakkety
dne
zesty
dne
ruby2.2
precise
dne
trusty
dne
utopic
dne
vivid
dne
wily
not-affected
xenial
dne
yakkety
dne
zesty
dne
ruby2.3
precise
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
xenial
not-affected
yakkety
not-affected
zesty
not-affected
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2015/07/13/6
http://www.securitytracker.com/id/1032874
https://github.com/ruby/www.ruby-lang.org/issues/817
https://www.ruby-lang.org/en/news/2014/08/19/ruby-1-9-2-p330-released/
http://www.openwall.com/lists/oss-security/2015/07/13/6
http://www.securitytracker.com/id/1032874
https://github.com/ruby/www.ruby-lang.org/issues/817
https://www.ruby-lang.org/en/news/2014/08/19/ruby-1-9-2-p330-released/