The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.

The support and utility classes used by the Rails 3.2 framework allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.

For Debian 7 'Wheezy', these problems have been fixed in version 3.2.6-6+deb7u2.

Additionally this upload adds 'active_support/security_utils' that will be used by ruby-actionpack-3.2 to address CVE-2015-7576.

We recommend that you upgrade your ruby-activesupport-3.2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been discovered in the Ruby on Rails web application development framework, which may result in denial of service, cross-site scripting, information disclosure or bypass of input validation.

rubygem-activesupport-3_2 was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-3227: Possible Denial of Service attack in     Active Support (bsc#934800).

Fixes for :

CVE-2015-3226 Escape HTML entities in JSON keys

CVE-2015-3227 XML documents that are too deep can cause an stack overflow, which in turn will cause a potential DoS attack.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ruby on Rails blog :

Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web console and jquery-rails plugins and Rack 1.5.4 and 1.6.2.

ID	Name	Product	Family	Severity
93131	Debian DLA-603-1 : ruby-activesupport-3.2 security update	Nessus	Debian Local Security Checks	medium
88499	Debian DSA-3464-1 : rails - security update	Nessus	Debian Local Security Checks	high
84997	openSUSE Security Update : rubygem-activesupport-3_2 (openSUSE-2015-506)	Nessus	SuSE Local Security Checks	medium
84479	Fedora 21 : rubygem-activesupport-4.1.5-2.fc21 (2015-10545)	Nessus	Fedora Local Security Checks	medium
84478	Fedora 22 : rubygem-activesupport-4.2.0-2.fc22 (2015-10538)	Nessus	Fedora Local Security Checks	medium
84255	FreeBSD : rubygem-rails -- multiple vulnerabilities (eb8a8978-8dd5-49ce-87f4-49667b2166dd)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-3227

high

Tenable Plugins

medium

high

medium

medium

medium

medium