GitHub Advisoryadvisory · RubyGems

GHSA-rg5m-3fqp-6px8 actionmailer email address processing causes Denial of service

MEDIUM Published 2017-10-24 Modified 2023-07-04 Official page ↗
Aliases
CVE-2013-4389
Ecosystem
RubyGems
Packages
actionmailer
Severity
Moderate
Weaknesses
CWE-134
Reviewed
2020-06-16

Affected packages

• RubyGems actionmailer: >= 3.0.0, < 3.2.15 → fixed in 3.2.15

Description

Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.

Related

Alias · CVE (1)

  • CVE-2013-4389 Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x… vulnerability

Weakness · CWE (1)

  • CWE-134 Use of Externally-Controlled Format String weakness

References