Denial of service in Ruby on Rails - CVE-2015-7581

Vulnerability identifier: #VU8584

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-7581

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.

Ruby on Rails
Fedora
rubygem-activemodel
rubygem-actionpack

Update to version 4.2.5.1.

rubygem-activemodel - update to 4.2.0-2.fc22
rubygem-actionpack - addressed in versions 4.2.0-3.fc22, 4.2.3-4.fc23

• https://rubygems.org/gems/rails/versions/4.2.5.1

• Multiple vulnerabilities in Ruby on Rails
• SUSE Linux update for portus
• Fedora 23 update for rubygem-actionpack
• Fedora 22 update for rubygem-actionpack, rubygem-activemodel