CVE-2014-6438 Denial of service in n/a
Remote attackers can cause denial of service in Ruby applications via crafted strings triggering catastrophic regex backtracking in URI decoding.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-6438?
CVE-2014-6438 is a high-severity denial of service vulnerability in Ruby-Lang Ruby, published on 6 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.
Weakness: CWE-399
Which versions are affected by CVE-2014-6438?
It affects 1 product.
Products include Ruby-Lang Ruby.
How do I fix CVE-2014-6438?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2014-6438 being exploited?
There is no known exploitation of CVE-2014-6438 in the wild and no public exploit code.
Other vulnerabilities in Ruby-Lang Ruby
Sources
Also known as DLA-275-1, GHSA-2j3h-55rq-rj48.