{"id":"CVE-2014-0082","published":"2014-02-20T11:00:00Z","modified":"2024-08-06T09:05:37Z","title":"actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type…","vendor":null,"product":null,"tier":"tail","description":{"text":"actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.06193,"percentile":0.93479,"provenance":"source"},"cwes":[],"references":[{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/LMxO_3_eCuc/ozGBEhKaJbIJ","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0215.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://secunia.com/advisories/57836","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0306.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://puppet.com/security/cve/cve-2014-0082","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://secunia.com/advisories/57376","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://openwall.com/lists/oss-security/2014/02/18/10","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.7,"factors":[{"name":"EPSS percentile","points":18.7}]},"affected":[{"ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=3.0.0, <3.2.17"],"patched":["3.2.17"],"from":["GHSA-7cgp-c3g7-qvrw"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-0186","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2013-0156","published":"2013-01-13","fixed":"3.2.11","kev":false},{"cve":"CVE-2013-1855","published":"2013-03-19","fixed":"3.2.13","kev":false},{"cve":"CVE-2013-1857","published":"2013-03-19","fixed":"3.2.13","kev":false},{"cve":"CVE-2014-0082","published":"2014-02-20","fixed":"3.2.17","kev":false},{"cve":"CVE-2013-4491","published":"2013-12-07","fixed":"4.0.2","kev":false},{"cve":"CVE-2013-6414","published":"2013-12-07","fixed":"4.0.2","kev":false},{"cve":"CVE-2013-6415","published":"2013-12-07","fixed":"4.0.2","kev":false},{"cve":"CVE-2014-0130","published":"2014-05-07","fixed":"4.1.1","kev":true,"link":{"from":"CVE-2014-0082","to":"CVE-2014-0130","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"3.2.17","toFixed":"3.2.18","daysApart":76}]}}],"package":"RubyGems:actionpack"}}