CVE-2024-47889CWE-1333

Action Mailer has possible ReDoS vulnerability in block_format

Medium · published October 16, 2024

CVSS v4.0
6.6
EPSS
1%
Percentile
60.5
In the wild
Unconfirmed
What it is

Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the block_format helper in Action Mailer. Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling the `block_format` helper or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected.

The record
Technical detail
CVSS v4.0
6.6 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
EPSS
0.00937 · 60.5th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2024-10-16T20:55Z
EPSS history
Timeline
  • 16 OCT 20:55Z
    Action Mailer has possible ReDoS vulnerability in block_format
    cvelistv5