CVE-2016-0751

Description

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.

References

https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9oLY_FCzvoc/5CDXbvpYEgAJ

http://www.securitytracker.com/id/1034816

http://www.securityfocus.com/bid/81800

http://www.openwall.com/lists/oss-security/2016/01/25/9

http://www.debian.org/security/2016/dsa-3464

http://rhn.redhat.com/errata/RHSA-2016-0296.html

http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html

http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3