CVE-2016-0751 actionpack is vulnerable to denial of service via a crafted HTTP Accept header
HighCVSS 7.5
EPSS 9.7%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems actionpack(RubyGems) | >= 4.2.0, <= 4.2.5.0 | No fix listed |
| rubygems actionpack(RubyGems) | <= 3.2.22.0 | No fix listed |
| rubygems actionpack(RubyGems) | >= 4.0.0, <= 4.1.14.0 | No fix listed |
| rubygems actionpack(RubyGems) | >= 4.2.0, < 4.2.5.1 | 4.2.5.1 |
| rubygems actionpack(RubyGems) | = 4.2.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.1.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.1.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.1.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.1.rc4 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.3.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.4.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.5.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.2.5.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | < 3.2.22.1 | 3.2.22.1 |
| rubygems actionpack(RubyGems) | = 0.9.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 0.9.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.1.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.10.1 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems actionpack(RubyGems) | = 1.10.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.11.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.11.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.11.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.2.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.3.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.3.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.4.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.5.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.5.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.6.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.7.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.8.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.8.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.9.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.9.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.1.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.1.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.1.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.2.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.2.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.10 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.11 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.12 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.14 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.15 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.16 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.17 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.18 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.7 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.8 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.8.pre1 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.9 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.9.pre | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.beta | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.beta2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.beta3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.beta4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.rc | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.10 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.10.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.11 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.12 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.12.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.13 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.13.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.14 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.15 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.16 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.17 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.18 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.19 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.20 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.4.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.5.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.6.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.6.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.7 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.7.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.7.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.8 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.8.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.8.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.8.rc4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9.rc4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9.rc5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.beta1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc6 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc8 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.1.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.1.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.1.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.10 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.11 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.12 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.2.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.2.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.4.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.5.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.7 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.8 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.9 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.0.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.0.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.10 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.11 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.12 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.13 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.13.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.13.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.14 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.14.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.14.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.15 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.15.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.15.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.15.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.16 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.17 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.18 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.19 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.2.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.20 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.21 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.22 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.3.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.3.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.4.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.7 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.7.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.8 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.8.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.8.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.9 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.9.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.9.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.9.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | >= 4.0.0, < 4.1.14.1 | 4.1.14.1 |
| rubygems actionpack(RubyGems) | = 4.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.1.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.1.rc2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- [ruby-security-ann] 20160125 [CVE-2016-0751] Possible Object Leak and Denial of Service attack in Action Pack mailing-list
- FEDORA-2016-94e71ee673 vendor-advisory
- FEDORA-2016-f486068393 vendor-advisory
- SUSE-SU-2016:1146 vendor-advisory
- openSUSE-SU-2016:0363 vendor-advisory
- openSUSE-SU-2016:0372 vendor-advisory
- RHSA-2016:0296 vendor-advisory
- DSA-3464 vendor-advisory
- [oss-security] 20160125 [CVE-2016-0751] Possible Object Leak and Denial of Service attack in Action Pack mailing-list
- github.com patch
- github.com patch
- github.com patch
- github.com exploit
- groups.google.com
- web.archive.org
- web.archive.org
- github.com
- github.com product
- Debian Security Tracker CVE-2016-0751 vendor-advisory
- 81800 vdb-entry
- 1034816 vdb-entry