{"id":"CVE-2019-5419","published":"2019-03-27T13:43:19Z","modified":"2024-08-04T19:54:53Z","title":"There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1…","vendor":"Rails","product":"https://github.com/rails/rails","tier":"tail","description":{"text":"There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.08778,"percentile":0.95137,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2019/03/22/1","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/","tags":["x_refsource_CONFIRM"]},{"url":"https://groups.google.com/forum/#%21topic/rubyonrails-security/GN7w9fFAQeI","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0796","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1149","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1147","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1289","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE"]}],"priority":{"score":19.0,"factors":[{"name":"EPSS percentile","points":19.03}]},"vendorSlug":"rails","affectedVersions":[{"vendor":"Rails","product":"https://github.com/rails/rails","versions":["5.2.2.1","5.1.6.2","5.0.7.2","4.2.11.1"]}],"affected":[{"ecosystem":"RubyGems","package":"actionview","vulnerableRanges":[">=4.0.0, <4.2.11.1",">=5.2.0, <5.2.2.1",">=5.1.0, <5.1.6.2",">=5.0.0, <5.0.7.2",">=6.0.0.beta1, <6.0.0.beta3"],"patched":["4.2.11.1","5.2.2.1","5.1.6.2","5.0.7.2","6.0.0.beta3"],"from":["GHSA-m63j-wh5w-c252"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0386","exploited":false,"provenance":"source"}}