CVE-2009-1904: Medium severity ruby-lang Ruby vulnerability

Published Jun 11, 2009

Updated

The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.

Affected Software

2 affected components

ruby-lang Ruby=1.8.7

ruby-lang Ruby=1.8.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ruby BigDecimal 1.8.6 to a version that resolves this vulnerability.
Fixed in p369
Upgrade
Upgrade Ruby BigDecimal 1.8.7 to a version that resolves this vulnerability.
Fixed in p173

Event History

Jun 11, 2009

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-1904?

CVE-2009-1904 is considered a denial of service vulnerability due to application crashes caused by large string arguments.

How do I fix CVE-2009-1904?

To fix CVE-2009-1904, upgrade to Ruby versions 1.8.6 p369 or higher, or 1.8.7 p173 or higher.

What versions of Ruby are affected by CVE-2009-1904?

CVE-2009-1904 affects Ruby versions 1.8.6 before p369 and 1.8.7 before p173.

What kind of attack is possible with CVE-2009-1904?

CVE-2009-1904 allows context-dependent attackers to exploit a vulnerability that can crash the application.

Is CVE-2009-1904 associated with a specific data type?

Yes, CVE-2009-1904 is particularly associated with attempts to convert large string representations of numbers to the Float data type.