VIR Vulnerability Intelligence Relay

CVE-2015-3225

medium
Published 2015-06-16 · Modified 2024-12-03
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
5.0

Description

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
suse SUSE Affected 2 releases
VersionStatusFixed in
13.2 Affected —
13.1 Affected —
debian Debian Mixed 7 releases
VersionStatusFixed in
trixie Fixed 1.5.2-4
sid Fixed 1.5.2-4
forky Fixed 1.5.2-4
bullseye Fixed 1.5.2-4
bookworm Fixed 1.5.2-4
8.0 Affected —
7.0 Affected —

Package impact
EcosystemPackageVulnerableFixed
ruby RubyGemsrack<>= 1.6.2>= 1.6.2
ruby RubyGemsrack>=1.5.0,<1.5.41.5.4
ruby RubyGemsrack>=1.6.0,<1.6.21.6.2
ruby RubyGemsrack>=1.4.0,<1.4.61.4.6

Application impact
VendorProductVersionsFixed
rack_projectrack{"endIncluding":"1.5.3"}
rack_projectrack1.6.0
rack_projectrack1.6.1

References

CWEs

CWE-19

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.